Luigi Auriemma

In section research I found a zip about Race WTCC.what is it?

wtcced is a program which decrypts and encrypts the files used in the Race WTCC and Race 07 games, useful in case you want to modify them like the .plr file containing informations and settings of your player or the various data files like .gmt, .trk and so on.

Using it is very simple since automatically decrypts the file if it's encrypted and viceversa, like the following examples:

decrypt:
wtcced username.plr plain.txt

encrypt:
wtcced plain.txt username.plr

Note that when you use the encryption sometimes is needed to specify the encryption type which is 1 by default (all the informations about the type of the original encrypted file are showed during the decryption process), so if you are working on the .plr file of Race 07 you need to use:

wtcced -v 2 plain.txt username.plr

or

wtcced -v 3 plain.gmt sr4_hood_a.gmt

Thanks a lot,but how you know the encrypt algortim?

The algorithm is blowfish so it's easy to find due to its tables.
Then for the key is enough to set a breakpoint to the initialization of the blowfish algorithm and it's done.

For example this is what signsrch finds in the race 07 demo executable:

offset num description [bits.endian.size]
--------------------------------------------
00353340 83 CRC-32-IEEE 802.3 poly 0x04C11DB7 [32.le rev.1024]
0055d270 190 Blowfish bfp table [32.le.72]
0055d2b8 192 Blowfish ks0 table [32.le.1024]
0055d6b8 194 Blowfish ks1 table [32.le.1024]
0055dab8 196 Blowfish ks2 table [32.le.1024]
0055deb8 198 Blowfish ks3 table [32.le.1024]
002e103e 289 MD5 digest [32.le.272&]
0056f0e8 309 padding used in hashing algorithms (0x80 0 ... 0) [..64]
0055d290 325 Haval hash pass2 [32.le.128&]
00353df8 357 Zlib dist_code [..512]
00353ff8 358 Zlib length_code [..256]
003540f8 359 Zlib base_length [32.le.116]
00354170 361 Zlib base_dist [32.le.120]
002bb12f 567 classical random incrementer 0x343FD 0x269EC3 [32.le.8&]
003540f8 1085 Rar29 LDecode [32.le.112]
002e103e 1287 RIPEMD-128 InitState [32.le.16&]
0055d270 1299 Haval init [32.le.32&]
0055d310 1301 Haval mc3 [32.le.128]
0055d390 1303 Haval mc4 [32.le.128]
0055d410 1305 Haval mc5 [32.le.128]
0055d3f0 1451 HAVAL1_DS [32.le.32]
0055d370 1453 HAVAL2_DS [32.le.32]
00354310 1523 zinflate_lengthStarts [32.le.116]
003537b0 1525 zinflate_lengthExtraBits [32.le.116]
0035438d 1526 zinflate_lengthExtraBits [32.be.116]
00354410 1527 zinflate_distanceStarts [32.le.120]
00353828 1529 zinflate_distanceExtraBits [32.le.120]
00353825 1530 zinflate_distanceExtraBits [32.be.120]
0055d2b8 1561 Blowfish_s_init [32.le.4096]

Mmm ok,I'm not an expert... I understand a little.... sorry for my english...I'm italian

Oh cacchio, un italiano che vive in Olanda?
Comunque se ti va' possiamo parlare pure italiano ih ih ih

Olanda?

Si in italiano ?? meglio!

Ho capito che hai visto nel codice dell'exe del demo che c'?? la stringa blowfish init e quindi hai capito che usava quell'algoritmo per criptare.
Invece non ho capito come ricavare la chiave :-(

ah no, mi sa' che ho fatto confusione io con l'olanda... dannati pensieri accavallati ih ih ih

Comunque una volta che sai dove sono situate le funzioni del blowfish devi seguire il programma con un debugger per capire quando viene passata la key (init) e naturalmente qual e'.
Diciamo che questa e' la parte un po' piu' lunga e a volte noiosa

Prima devo decompilare l'exe per??, cosa usi?
SoftIce potrebbe fare al caso mio?

ollydbg (http://www.ollydbg.de) o immudbg (http://www.immunitysec.com/products-immdbg.shtml) per debuggare il processo.
Sono free quindi butta softice ih ih ih

Ma come mai ti interessa debuggare wtcc?
tanto l'algoritmo e le chiavi sono pubbliche

How to extract multiple files in one shot?

Download the find.exe tool from here:

http://gnuwin32.sourceforge.net/downlin ... in-zip.php

and use it as in the following example:

c:
cd "\program files\Race - The WTCC Game\gamedata"
find -exec c:\wtcced.exe "{}" "c:\decrypt\{}" ;
or
find -iname "*.dds" -exec c:\wtcced.exe "{}" "c:\decrypt\{}" ;

the first step allows us to enter in the WTCC gamedata folder
then we find all the files and execute c:\wtcced.exe
or we do it only for the dds files

note that on linux you must use \; instead of ; at the end of the find command

How to extract multiple files in one shot?

Download the find.exe tool from here:

http://gnuwin32.sourceforge.net/downlin ... in-zip.php

and use it as in the following example:

c:
cd "\program files\Race - The WTCC Game\gamedata"
find -exec c:\wtcced.exe "{}" "c:\decrypt\{}" ;
or
find -iname "*.dds" -exec c:\wtcced.exe "{}" "c:\decrypt\{}" ;

the first step allows us to enter in the WTCC gamedata folder
then we find all the files and execute c:\wtcced.exe
or we do it only for the dds files

note that on linux you must use \; instead of ; at the end of the find command

hi I have a problem using that comand it says something like a missing libintl3.dll, can you make a batch file to make as noob users life a bit easier:)

thanks

The DLL required by find.exe is available here:

http://gnuwin32.sourceforge.net/downlin ... in-zip.php

about the .bat file check the attached one I have created in this moment and follow this steps:

- rename the attached file as wtcced_all.bat
- create a new folder in C: called wtcced (c:\wtcced\)
- copy your GameData folder in C:\wtcced
- copy wtcced_all.bat, wtcced.exe, find.exe and libintl3.dll in c:\wtcced
- execute wtcced_all.bat
- at the end of the process you will see a new folder called decrypt (c:\wtcced\decrypt) containing a new GameData folder with ALL the decrypted files

wow... that was fast, I??ve tried that but now it says i misses the libiconv2.dll, I??m trying to search for that dll in google but no sucess till now:(

libiconv is here:
http://gnuwin32.sourceforge.net/downlin ... in-zip.php

If you need other files take them from the gnuwin32 website:

http://gnuwin32.sourceforge.net/packages.html

It worked fine Luigi, thank??s a lot, and thanks again for answearing so fast.

Did you try to decrypt GT Legends files? Should be a similar algorithm, but hasn't been cracked yet.

The algorithm is probably just the same (GTR2 too) but the key is different and I don't know it

well i didnt read every post here, but are the car ''setting'' files there too ? .. so i can change vehicle specs ? (top speed, number of gears ..etc)...i dont have game installed right now, so i cant look.

Is this because Starforce is blocking debuggers? Or do you just not own the game?

the first one

There is always the possibilty to try a brute force attack on the key. How much of a help would be the fact that we know part of the clear text, like for instance, all .trk files start with the sequence "CUBEASF", and all .gdb start with the track name?

I don't think it's possible (and I don't have the needed knowledge too)

isnt it possible to get game's source code from somewhere ?

Recently I found out that some rFactor files are also encrypted, for example the F1 BMW Sauber model. Do you know the key ?

I know the keys only for the Race WTCC games

can't decrypt new GTR addon for Race WTCC, it says "- file version 5" "Error: unsupported file version".
can you add support for new file version?

I have just released version 0.2.2

THX Luigi :)