Leo D. Marstone

Well-Known Member
Nov 2, 2017
1,207
1,171
RPA normally uses a standard format to store the information called RPA-3. The data is encrypted in the simplest possible way by taking the binary exclusive or (XOR) of each byte with a provided integer, the key. The key can be found in a standard place in the RPA file, making it rather pointless to be honest. It then uses a normal off-the-shelf compression method to decompress the data.

This particular product did it different. They've come up with a custom method, and they've called it RPA-9.1 for some reason. It uses the same normal compression as RPA-3, and the same XOR technique, but the key isn't available in the standard place. It's hidden in a compiled, binary DLL and accessed by some custom python code. Much more significantly though it also has another trick up its sleeve: once the data is uncompressed and decrypted, it's all sent to the DLL for further processing. Some native, compiled code uses a very long key to then XOR the entire file a second time, and returns it to Renpy. The process is all obfuscated somewhat, including code that deliberately doesn't do anything to throw off anyone trying to work it out, though not very effectively. I just wrote some python code that does what the DLL does and included it inside unrpa.
1725901079658.gif
 

youraccount69

Well-Known Member
Donor
Dec 30, 2020
1,658
623
HitomisSickPleasure-0.63.5
You don't have permission to view the spoiler content. Log in or register now.
rpdl torrents are unaffiliated with F95Zone and the game developer.
Please note that we do not provide support for games.
For torrent-related issues use here, or join us on !
, . Downloading issues? Look here.​
 

randomname2243

Active Member
Oct 26, 2017
666
689
l am convinced, that this game tries to be psychological horror in some kind of way. But not in the way l .
Even if it doesn't try it, l feel the need to stay away from it(the fetishes here have nothing to do with it). Hilarious stuff for sure.
 

HypnoKitten

Member
Feb 14, 2018
225
464
yaaaay updates! and just played through it! And the art is totally improving! for some reason the bbc route... I'm not clicking with it as much as the others. Its not that its bbc, or that the dialect is way over the top 'trying really hard to sound black', that's fine. But the energy is weird. I can't fully put my finger on it...

I think in all the other paths so far she's getting corrupted, kinda resisting and hating it until she's mind-broken, or resisting but secretly loving it, and there are these big baddies out there pushing her into depravity and going 'muahahaha!' as they do. With this route she starts kinda blaze about it - 'oh, ok, guess this is happening now' (a feel that never fully goes away throughout except for a few seconds when she's about to cum). Then the first 'big baddie' is just kinda super-chill and kinda trying to help her (but then also sells her out which, super-weird). And the second 'big baddie' is just getting his rocks off but doesn't really care if she gets corrupted or not. He's pulling her into sluttification (yay) but neither he nor her seem to particularly care about it or get excited about the process like in the other paths. And then the surprise at the end, I can see what path that's opening up... but again, the person being surprised feels like he's just 'huh.. k, guess that happened' and already knew... which is kinda intriguing but also sort've just deflates all the energy a bit...

I don't know, we'll see where it goes. Just playing through right now doesn't quite feel as awesome (or depraved) as some of the other paths I've been excited about.
 
  • Like
Reactions: AdHyde and ktez

GammaTheOne

Newbie
Jun 13, 2017
48
48
drag the archive.rpa file to the unrpa.exe file right in your windows explorer
Thank you so much! I feel both grateful and like an idiot, I kept trying to use a command prompt. For some reason my brain couldn't think to just drag the rpa to program.
Also follow up question, where is the password located in the extracted files?
 
Last edited:

tankie123

Member
Nov 17, 2017
139
94
Thank you so much! I feel both grateful and like an idiot, I kept trying to use a command prompt. For some reason my brain couldn't think to just drag the rpa to program.
Also follow up question, where is the password located in the extracted files?
i think it's in bcrypt's hash , you'll need a script to brute force it
 
  • Like
Reactions: GammaTheOne
Jun 21, 2020
129
209
I'm open to suggestions, I have no idea what I'm looking for inside the .dll
It's near the top of the `.rdata` section. `.rdata` starts at `0000000070C19000h`. Obviously I've added the name `EncryptionKey` in IDA. None of these things have external symbols.

ida64_YuVyAoYfQP.png

You will, however, also need to find the value `0x46D96FA8FAD5262B` hidden in one of two functions exposed to python as `get_file_index` and `normalize_offset`, and find the value `0x126E6680` hidden in a function appropriately exposed as `get_key`. The decryption is done by a function exposed as `normalizer`. Additionally there is code that apparently tries to delete ".rpy" and ".rpyc" files unless the global `i_am_a_donkey_4128` is defined.
 
  • Like
Reactions: tankie123

GammaTheOne

Newbie
Jun 13, 2017
48
48
It's near the top of the `.rdata` section. `.rdata` starts at `0000000070C19000h`. Obviously I've added the name `EncryptionKey` in IDA. None of these things have external symbols.

View attachment 4018208

You will, however, also need to find the value `0x46D96FA8FAD5262B` hidden in one of two functions exposed to python as `get_file_index` and `normalize_offset`, and find the value `0x126E6680` hidden in a function appropriately exposed as `get_key`. The decryption is done by a function exposed as `normalizer`. Additionally there is code that apparently tries to delete ".rpy" and ".rpyc" files unless the global `i_am_a_donkey_4128` is defined.
Is there a particular program you can recommend to make the process easier? I've been searching online but haven't had much luck, I've been trying dnSpy and dotPeek, but had no luck with either one.
 
Jun 21, 2020
129
209
Is there a particular program you can recommend to make the process easier? I've been searching online but haven't had much luck, I've been trying dnSpy and dotPeek, but had no luck with either one.
You could try IDA Pro, or the freeware version, or Ghidra. But I wouldn't necessarily recommend trying to do this in the first place. It's true that millions of people could have probably reverse engineered this straightforward obfuscation pretty easily, but that's because millions of people have spent years learning these things. You don't sound like you have. You could spend years learning it too, if you wanted, but short of that you're not going to get far. I mean no offense of course, I'm just saying that assembly code isn't something you want to wade into unprepared.
 
  • Like
Reactions: tankie123

droglob

Active Member
Aug 26, 2017
571
1,359
l am convinced, that this game tries to be psychological horror in some kind of way. But not in the way l .
Even if it doesn't try it, l feel the need to stay away from it(the fetishes here have nothing to do with it). Hilarious stuff for sure.
Most Western "NTR" games are Silence of the Lambs tier examples of psychopathy. Some serious mental illness is poured on to these things.
 
4.10 star(s) 20 Votes