.btrq file format - how to decrypt/read it ?

Sethioz · **Posted:** 09 Jun 2009 05:42

as far as i know this kind of files are used in some NFS games and also in Test Drive Unlimited. it should hold vehicle's data in it (possibily some other data too). im not sure if it's encrypted or just compressed, but really could use a tool to read / edit it in readable format.

I have included an example file from test drive unlimited.

aluigi · **Posted:** 09 Jun 2009 12:08

I don't have the game anyway it's very probable that it's blowfish judging the padding of the file and the presence of the blowfish algorithm inside the executable.
I have already tried some keys but I guess it's the %08X of some number... anyway they are only hypothesis.
maybe (if we have the same exe) try to put a breakpoint on 0062cb90 and check the stack arguments

Sethioz · **Posted:** 09 Jun 2009 22:56

i don't seem to find that address (it is address right ?)
opened it with olly, but they start from 00F
not sure if .exe would help you, but i uploaded it. maybe you can take a look.
http://www.sx.brutalcore.co.uk/stuff/Te ... imited.rar
oh yeah and i found some interesting stuff for TDU > tdu modding tools, when i open the .bnk file (which contains the .btrq file) it shows some kind of memory position where that file should be. would that help ?

aluigi · **Posted:** 10 Jun 2009 08:58

blah that exe sux because it's still encrypted except the non-executable part, so you need to put a memory breakpoint on 00f56b20 and 00f56ad8 and then setting a breakpoint at the beginning of the functions which use them.

instead if you use the nocd http://m0006.gamecopyworld.com/games/pc_test_drive_unlimited.shtml#Test%20Drive%20Unlimited%20v1.66a%20[MULTI7]%20No-DVD/Fixed%20EXE the direct offset is 0062fc10 (it's ok also the one I told you before, this new one is directly the blowfish key init)

Sethioz · **Posted:** 11 Jun 2009 04:53

as usual nocd is nouse, game doesn't work as it should, but it runs, so i guess its enought.
do i need to attach or open ?
i tried both and on both cases can't see such addresses. ..im using olly ofc.

aluigi · **Posted:** 12 Jul 2009 11:37

job done:
http://aluigi.org/papers.htm#tdudec

Sethioz · **Posted:** 12 Jul 2009 15:41

nice work :) seem to be working just fine

Luigi Auriemma

.btrq file format - how to decrypt/read it ?