Monster Hunter Rise: Sunbreak save encryption

[Nimer]

Hey guys!

I'm considering building Switch <=> PC save game transfer tool. Due to the fact that going through ASM code of really anything is a tedious work, I would love to ask you, my dear gbatemp hackers, if you're aware of anyone already in possession of a tool for Switch Monster Hunter Rise: Sunbreak decryption who would like to share?

Thanks in advance!

 

[iZero]

wow!! seem like save editor will coming soon. lol

 

[HalfScoper]

Hey guys!

I'm considering building Switch <=> PC save game transfer tool. Due to the fact that going through ASM code of really anything is a tedious work, I would love to ask you, my dear gbatemp hackers, if you're aware of anyone already in possession of a tool for Switch Monster Hunter Rise: Sunbreak decryption who would like to share?

Thanks in advance!

I think you should get in touch with the people of the Cheats Hunter Discord if you are really invested.

 

[Nimer]

wow!! seem like save editor will coming soon. lol

I wouldn’t go as far as say it will happen soon. I’ve a normal day job and reverse engineering ASM code isn’t exactly my forte XD.

 

[Nimer]

I think you should get in touch with the people of the Cheats Hunter Discord if you are really invested.

Thanks, I did reach out there.

In the past I got help here when I’ve been working on MH Portable 3rd translation tools and hoped for another stoke of luck

 

[unknowndatax]

Not sure how far you've gotten, but I just started looking into the PC version. From what I noticed, it reuses encryption from monster hunter world. Once the save is encrypted, it uses a murmur hash as verification.

 

[Setzer_]

Not sure how far you've gotten, but I just started looking into the PC version. From what I noticed, it reuses encryption from monster hunter world. Once the save is encrypted, it uses a murmur hash as verification.

Could you expand on this? I've been looking at the encryption for the past couple days. I'm still a noob at reversing, so I've so far been able to dump the unencrypted save file memory buffer and identify the instruction where the encryption is happening.

Have you been able to find or do you know what encryption method is being used?

 

[unknowndatax]

When I looked into it more a few weeks ago, it seems to be using a 128-bit block cipher. The developers call it XS if you look at their strings. At offset 0x08 in the save file, that will tell the game what type of encryption, if any, to use. If I remember correctly, 0 is for not encrypted, 2 is for blowfish, 4 is for XS, 8 is something for the switch. I currently don't have much time to work on the encryption, but I did manage to get the hashing. I put a link below to c# code.

Monster Hunter Rise Hash

 

[Setzer_]

Thank you! This is all great info. I'll check it out tomorrow. How were you able to recognize the user of blowfish vs XS? And I'll try to look at the strings as well. Do you know how you found that info about it being XS?

Thank you again! Sorry if that's too many questions.

I believe I was able to find the hashing function with the constants in the code you linked, so thanks once more. I haven't found this section of the code yet, so I'll have to see how it's used in game.

 

[unknowndatax]

The Re engine is just a modified version of the Unity engine. If the metadata isn't protected, it makes reverse engineering a lot easier. All I did was look for method names to determine what they were using since the strings weren't protected. To verify blowfish and murmur hash, I just searched for constants and found them in the decryption method.

 

[Setzer_]

Thank you again. I'll try to look into the strings. I think I neglected those because Ghidra doesn't have a way to easily search for UTF-16 strings.

When you say you search for constants, how are you doing that/what are you looking for? Currently I've been using Cheat Engine + Ghidra. Is there another more effective tool I can be using?

Again, sorry for the questions. Like I said, I'm pretty new at this and still trying to find my footing (what to use, where to look for answers, etc.)

Edit: Already finding some possibly useful stuff with string searching! I found out how to do a proper string search in Ghidra and I'm finding mentions of blowfish and XS like you mentioned. Still not sure about how to effectively look for constants, but maybe I'll get there

 

[StringIsNullOrEmpty]

Many have tried, all have given up as far as I'm aware.
I don't think the encryption scheme is documented for either game, at least not publicly.