Max Payne 3 Modding

[Vulnavia]

Ok, i tested it twice and there seem to be more than this one because i got the corrupt Message again even if changing only one Byte... I btw. supposed the same Location as you too, looked suspiciously like an Sum24 but there is also another one just after an static $24 that is exactly 192Bit long but i was not able to figure out what it could be, perhaps i just not have the right Range, dunno tested different Ranges...

edit: Ok, with your Information i can confirm, the first CRC is 100% an Sum24 or Sum32 but does not matter of the Secure Block, i missed the Time/Date first, but if i skip it Sum24 is correct.... I will now try to identify the other one thanks to you Information i hopefully have the correct Range now, many thanks!

[JizzaBeez]

Ok, i tested it twice and there seem to be more than this one because i got the corrupt Message again even if changing only one Byte... I btw. supposed the same Location as you too, looked suspiciously like an Sum24 but there is also another one just after an static $24 that is exactly 192Bit long but i was not able to figure out what it could be, perhaps i just not have the right Range, dunno tested different Ranges...

edit: Ok, with your Information i can confirm, the first CRC is 100% an Sum24 or Sum32 but does not matter of the Secure Block, i missed the Time/Date first, but if i skip it Sum24 is correct.... I will now try to identify the other one thanks to you Information i hopefully have the correct Range now, many thanks!

The checksum that I mentioned is a Checksum32 (32bit / 4 bytes). I don't think I've ever seen a game developer use a 24bit checksum... And I think the "Secure Block" that I mentioned is probably encrypted. I don't think it's compressed because there is no "Magic Number" like most compressions use. And if it is indeed encrypted then you won't be able to edit any of it without first decrypting it then encrypting it back because if you did edit it then the game couldn't decrypt it correctly.

Could you maybe try to edit the Time/Date that I showed and see if the file corrupts after editing it? If it does corrupt then that means there is another checksum/hash before the Time/Date.

[Vulnavia]

Yeah its Sum32 logically because its stored as a 32Bit Integer but Sum24 is the same so well does not really matter, that what i meant...

And i too supposed its encrypted or perhaps compressed too, can't check it and if there is no magic Number it does not mean the Block can't be compressed, they could have compressed it and then encrypted it, well i don't hope it buts its possible...

I also checked the secure Block and the Values in the unknown Blob with all known hashes and CRC's, but no one match...

So it could be that the crc is taken on the plaintext and then the block is encrypted so i will not be able to find it without decrypting it or also like you mentioned, its because it can't decrypt it after i change something, but normally there should not be any problem to decrypt the changed Bytes without corrupting the rest of the Block... But if they compressed it before encrypting, yeahh then it will fail on decompressing it after decrypting the bad Bytes, but till i don't know more its pure Speculation anyway...

Or also the CRC is taken and then encrypted somehow like a MAC then its the same Problem no way to compare without decryptng it, well i will analyze it later, i'm to tired actually anyway...

[Mystic2011]

You guys lost me...


---
I am here: http://tapatalk.com/map.php?do1ezb

[Vulnavia]

So far i still don't know what the Blob is, but the static $06 before could be a amount of Records, because the Bytes can be devided by 6, so perhaps the secure Block is devided into 6 pieces and then 6 crc's are taken or so, but still pure speculation and probably i'm thinking to far...

Also there is a static $24 at 0x23 within the Blob and also many Static Bytes within the Secure Block whats probably is because of the Cipher repetitiveness, else it would be mixed up much more and certainly not so much static Bytes would be left...

After comparing Saves together i don't think its compressed, because the static Bytes are always at the same Location even if the Secureblock is becoming bigger they stay there, if it would been compressed the Location would probably change if the Block is getting bigger...

So for me it looks like, as you progress in Game more Data is added below in a always same Pattern and the Block then encrypted with a repetitive Key, and because of that the Bytes are static and located always at the same Location, this also means the Key is static too and is probably saved in the xex, so it would be nice to get the xex to get the Key and the Algo used... ;)

Also the Blob could contain the secondary Hash in encrypted form probably encrypted the same way with the same Key or one taken from Plaintext, then there is anyway no going further before we have the Algo and the Key...

Does anyone have the Default.xex of this Game?

[Mystic2011]

I do


---
I am here: http://tapatalk.com/map.php?amgevm

[NuBiXx]

So far i still don't know what the Blob is, but the static $06 before could be a amount of Records, because the Bytes can be devided by 6, so perhaps the secure Block is devided into 6 pieces and then 6 crc's are taken or so, but still pure speculation and probably i'm thinking to far...

Also there is a static $24 at 0x23 within the Blob and also many Static Bytes within the Secure Block whats probably is because of the Cipher repetitiveness, else it would be mixed up much more and certainly not so much static Bytes would be left...

After comparing Saves together i don't think its compressed, because the static Bytes are always at the same Location even if the Secureblock is becoming bigger they stay there, if it would been compressed the Location would probably change if the Block is getting bigger...

So for me it looks like, as you progress in Game more Data is added below in a always same Pattern and the Block then encrypted with a repetitive Key, and because of that the Bytes are static and located always at the same Location, this also means the Key is static too and is probably saved in the xex, so it would be nice to get the xex to get the Key and the Algo used... ;)

Also the Blob could contain the secondary Hash in encrypted form probably encrypted the same way with the same Key or one taken from Plaintext, then there is anyway no going further before we have the Algo and the Key...

Does anyone have the Default.xex of this Game?

Here is Default.xex, there was Default.xex on both disks so I put both of them.
https://rapidshare.com/files/1908765746/default.XEX.rar

[69bigplayer69]

did u try using this Max Payne 3 - Resigner?