Luigi Auriemma

Has anyone done any research on the mpdata file format for the various Call of Duty games (4 and 5 in particular)? I am interested in decrypting it and/or figuring out how data is stored in it to see if it would be possible to have custom stats. For CoD 4, this file is stored in ...\call of duty 4\players\profiles\PlayerName\mpdata. I believe this file is encrypted by the cd-key of the player who last used the file.. and this will become obvious if you continue reading below.

It's possible to use a "friends" cd-key & mpdata file that they have built up... and have their stats. Then, you just change back the cd-key on your own in game. I have tested this, and it works. Here is how it's done in CoD4:

1) Be sure the game is closed, replace your mpdata file with someone of a higher rank (don't forget to make a backup just in case)
2) Change your CD key to the cd-key that your friend is using via the registry (HKEY_LOCAL_MACHINE\SOFTWARE\Activision\Call of Duty 4\codkey)
3) Start the game, and you now have their stats/cd-key. Goto Options > Multiplayer Options > Enter Key Code.. and change your cd-key back to your own. Now go play a game and get a few kills/deaths to update the stats a bit.
4) Disconnect, close the game, and start it back up. You should now permanently have your "friends" stats with your own cd-key!

This is great, but it would be nice to be take out the "friend" part and just be able to decrypt out own MPDATA, modify the data, and re-encrypt it with our own cd-key. It's obvious that when you change your cd-key within the game, the mpdata file is "re-encrypted" with your cd-key... so I think this might be possible.

Another interesting thing, it seems that all MPDATA files are 8476 bytes for CoD 4 and 5. This was tested on different computers, installations, etc... Also, I have attached a sample MPDATA file. It may or may not be of any help. The mpdata files all appear to all start with "iwm0" ...and after that the data changes (infinity ward... something something...).

Anyways.. has anyone looked into this, or have any idea how this file works? Thanks for the help.

it's a customized algorithm based on tea.
I will release the decrypter later

Thanks! Very nice work. Any way to encrypt the output again with a different cd-key (back into an mpdata file)?

Also, the decrypted data looks pretty jumbled, so I'm guessing they don't make it very easy to be modified :(

But still interesting. Thanks for taking the time to research that!

done, released version 0.1.1 :)

Great work! Works perfect. I will make a note for anyone interested in this tool that might answer some questions:

In Call of Duty 5: the profile name you create is tied to a cd-key (through demonware) when you create it. When you create a new profile name, it must not be tied to another cd-key (profile names are unique, two players (cd-keys) can't use the same profile name). When you start up the game, your cd-key is sent to demonware, and your profiles that you have created on that cd-key are sent back to your client. Some other info is also sent to you such as your friends list, and probably other stuff (though I don't know exactly what because it's encrypted data.. so this is mostly an assumption based on reading what the console is reporting).

Stats are still completely local though... but the reason I mention all this is because you can't transfer your profile name over to another cd-key unless you delete it first through the client on your old cd-key (thus freeing up the profile name for anyone to use). Once you have created your profile name on the new cd-key.. just re-encrypt the mpdata file with the new cd-key and copy it back where needed.

Since Call of Duty 4 doesn't use demonware, profile names aren't unique... and the information above doesn't apply to it.

Also Luigi, this is a little off topic, but do you know what md5 seeds/calculations are used to go from cod5 cd-key > punkbuster guid? If you don't have the beta or retail game installed, don't worry about it... but this has also interested me recently. It seems they like to change the way it's done with each game :P

md5 hash of the bracketsless cdkey with the seed 0x00b684a3
and then md5 hash of the previous md5 hash (in hex mode, so with a length 32 bytes) with seed 0x51a56

Awesome! I had trouble at first, but it appears to want the key in all lowercase 8), now it works. Thanks Luigi!

ops yeah, I used key2pb and I forgot to specify that :)
anyway I have just updated key2pb for testing the various seeds combinations easily, for example using: key2pb CDKEY 0x00b684a3 0x00051a56

the tool is available at http://aluigi.org/papers/key2pb.zip but it's no longer indexed in my Research page by various months because it's not a tool for final users but only something for "blind" or specific tests like in this case.

I had a problem several prestige levels ago where I chose to "advance" to the next level, and lost all of my progress. Naturally, I started looking for a way to regain what I had lost. Sure, I could hit a rank-up server, but that's cheesy.

Then I hit on this thread, and I just wanted to say Thank You! After decrypting the mpdata file and doing a bit of sleuthing, I was able to achieve my goal.

@SomaFM, not sure what you mean by "custom stats" though. You mean like changing your level to '666'? Or ... ?

Well basically, the tool is only for encrypting/decrypting the mpdata file with a certain cd-key so you can "give" your stats to another player, or change your cd-key but keep your stats.

I was looking for a simple way to have custom stats, like maybe I only want to be on my 2nd round of prestige mode, and at level 45 with my pick of achievements. Right now, you must have a valid mpdata file created by the game, or one from another player so that you can encrypt/decrypt it with the tool. You can't really have the stats that YOU want to have, and that is what I was looking for.

A forum user at netcoders.cc has a tool that will back up your stats, or give you spoofed stats like level 65, or level65 and all prestige modes completed... but there are no kills/deaths/etc.. associated with the record. It's just a clean profile with either of those 2 ranks. I was looking for a way to customize every aspect of the mpdata file; however, since the data is not in plain text it will take a bit more work that would be a bit too complex for me :P

Well, I think I can help some with the customization part. At least, I can tell you what I've figured out so far. I'll PM you. If anyone else is interested in this cruft, I'll assume they'll post here or PM me.

How do i use this? I run the exe and a cmd prompt shows up for a split second then disappears?

Im running win xp.

Thanks.

it's a command-line tool: http://aluigi.org/about.htm#howuse

ok, i got it to work.. Sort of.. I run it, but it said the hash doesnt match.. any suggestions? Im using it on cod4 v1.7 mpdata file. Also, You can edit the mpdata to change unlocks and such with this right? after its decrypted?

the alert "the hash doesn't match!" means that the cdkey you provided is not the correct one which was used to encrypt the file or isn't in the right format.
like it's written at runtime the cdkey must be the same like it is in the registry:

write, i got that.. Maybe because im trying to decrypt a modded servers mpdata and not my actual player mpdata?

the cdkey is the encryption key so if it's wrong (you don't know the exact one) you will be not able to decrypt the file

Every time when I want to decrypt mpdata with key (I know key) it doesnt work= hash doenst match...

What should I do???

it's a key based algorithm with an hash which says at 100% if the input key is correct or not, so if it says that the hash doesn't match means that the key is wrong and there is nothing you can do

Hi Luigi, I am also trying to use this great tool. I have some feedback for you:
I have tried for both cod4 and cod5, with the keys upper and lower case.
When running it on a cod4 file, the program says the hash doesnt match. With a cod5 file, it doesn't give hash error message, but still the output file is garbled.
I have double checked the key values I was using against my registry values, and against the sticker on my game box.
In terms of platform, I am running vista 64.

Could you please offer some advice on how to get this working for us? Thankyou very much, we appreciate it.

ok I'm going to verify it again and then I will tell you the updates

have you read and followed the instructions showed at runtime by the tool?
practically you must not insert the whole cod4 cdkey but only its first 16 chars (AAAABBBBCCCCDDDD).
while for cod5 they must be 20 (AAAABBBBCCCCDDDDEEEE).

please retry following these guidelines and tell me if the problem is solved with both the games or at least cod4.

in the meantime I check if there is something different with cod5 but I doubt because the hash is calculated on the decrypted data so if the resulted hash is the same of the original one it means just that it's the real exact content (even if garbaged).

Just tested, and it's working fine in CoD5 on my end. I'm also using the latest patch.

Oh forgot to note, if you're expecting it to be in plain text and easy to edit...it won't be. FadedAce sent me a pm a while ago that explained the file structure in great detail. Here is a pastebin of his PM: http://pastebin.com/f16e7ea57

Ahhh, the penny drops.

Luigi: Thanks for verifying your code for me. You're right. I did see that the instructions said to use less chartacters for the cod4 decryption process, but it didn't twig in my mind that that meant to truncate my key.

SomaFM: Thanks for reading between the lines and working out my problem. I was naively hoping for a nice textual format, but just it just being in a big blob of binary values makes sense. Also thanks for that pastebin, it will come in very handy for what I'm trying to do. I'm also a big fan of SomaFM the station :)

Just to let you guys know what I'm doing, I made this little mpdata backup utility a while ago (http://cod4backup.codeplex.com). I run it before each day's play (both cod4 and 5), and so now I have a huge collection of mpdata files spanning a couple of years. My plan is to use Luigi's insanely clever decrypt code to parse over my whole collection and spit out the data into a excel file, so that I can graph my changes in performance over time. I'll link you fellas up when I'm done.

tomorrow I will release a 0.1.1a version which will convert the "Alert: the hash doesn't match!" message in an error with the suggestion of trying less character because it can be a common error (I did the same error after I performed the test after having read your previous post ah ah ah).

I have decrypted the file and I am trying to figure out what I should use to edit the output.txt or figure out what everything does. The pastebin didn't explain much to me.

I myself have CoD5 for the XBox, and I don't want to go through all the rank motions all over again.

I'm looking to make an mpdata or getting another mpdata that looks legit so I could encrypt it for my key.

Heh I fail for not reading the pastebin correctly. I think I got it. Hopefully we can figure out those question mark items.

Alright. So after reading the pastebin again and opening the output.txt in a hex editor. I still found no entries that matches anything in my stats.... I have a feeling the mpdata did not decrypt correctly?

EDIT: Attached output