Alexo19

New Member
Feb 28, 2018
9
0
Is it posible extract text and pictures from the game? I try open with decompiler but not find anything.
 

FFTW

Member
Jun 7, 2017
493
579
when I try to start the swf I get met with a blue screen then it closes. any help?
 

INeedSomeCats

Newbie
Jun 6, 2020
45
13
how can i use the magic book?
It appeared with the Magic Gloves, but has not been found anywhere since the first interaction.
 

ylb5000

New Member
Aug 13, 2016
6
24
Is it posible extract text and pictures from the game? I try open with decompiler but not find anything.
Sure, I extracted them. I will describe more details later...

I've analyzed some code from MVOL 1.0.1 decompiled by ffdec, then concatenated splitted binary datas with HxD. As the binary were partially encoded with xor and some deltas, I wrote a Python script to decode it.
Python:
def overwritef(ba, offset, value):
    for i in range(len(value)):
        ba[offset+i] = value[i]

with open('concated.bin', 'rb') as f:
    ba = bytearray(f.read())

overwritef(ba, (0 << 24 | 103 << 16 | 156 << 8 | 169), (51 << 24 | 205 << 16 | 230 << 8 | 166).to_bytes(4, byteorder='little'))
overwritef(ba, (1 << 24 | 160 << 16 | 155 << 8 | 61), (196 << 24 | 198 << 16 | 235 << 8 | 138).to_bytes(4, byteorder='little'))
overwritef(ba, (0 << 24 | 183 << 16 | 122 << 8 | 192), (162 << 24 | 134 << 16 | 106 << 8 | 43).to_bytes(4, byteorder='little'))
overwritef(ba, (0 << 24 | 133 << 16 | 213 << 8 | 5), (250 << 24 | 216 << 16 | 103 << 8 | 27).to_bytes(4, byteorder='little'))
overwritef(ba, (0 << 24 | 82 << 16 | 6 << 8 | 176), (120 << 24 | 206 << 16 | 59 << 8 | 39).to_bytes(4, byteorder='little'))
overwritef(ba, (0 << 24 | 15 << 16 | 28 << 8 | 45), (111 << 24 | 51 << 16 | 234 << 8 | 22).to_bytes(4, byteorder='little'))
overwritef(ba, (0 << 24 | 226 << 16 | 166 << 8 | 177), (254 << 24 | 145 << 16 | 39 << 8 | 195).to_bytes(4, byteorder='little'))
overwritef(ba, (1 << 24 | 59 << 16 | 39 << 8 | 44), (119 << 24 | 240 << 16 | 153 << 8 | 117).to_bytes(4, byteorder='little'))
overwritef(ba, (1 << 24 | 102 << 16 | 83 << 8 | 30), (143 << 24 | 25 << 16 | 225 << 8 | 2).to_bytes(4, byteorder='little'))

k = 0x4d
for i in range(0 << 24 | 194 << 16 | 69 << 8 | 190): 
    ba[i] ^= k
    k ^= ba[i]

with open('complete.swf', 'wb') as f:
    f.write(ba)
The main ActionScript code is attatched below...
 

ylb5000

New Member
Aug 13, 2016
6
24
If you open the swf file with decompiler, you can see 5 splitted binaries and 5 corresponding packages, with a loader package.

Let's take a look at somewhat decode function. (As some lines aren't correctly decompiled, you need to analyze the P-Code)
JavaScript:
public function OGHN3KnSVvz0sQ0C()
{
    super();
    this.loader = new Loader();
    addEventListener(Event.ENTER_FRAME,this.enterFrame,false,0,true);
    if(stage)
    {
        stage.addChildAt(this.loader,0);
    }
    new ByteArray().endian = Endian.LITTLE_ENDIAN;
    new ByteArray().length = 2 << 24 | 40 << 16 | 152 << 8 | 223;
    new ByteArray().position = 1 << 24 | 29 << 16 | 203 << 8 | 220;
    new C0a4qGL6E9N1Ijaj().endian = Endian.LITTLE_ENDIAN;
    new ByteArray().writeBytes(new C0a4qGL6E9N1Ijaj(),0,0 << 24 | 75 << 16 | 140 << 8 | 230);
    new ByteArray().position = 0 << 24 | 120 << 16 | 114 << 8 | 235;
    new §4l9JT7u2nN1ZFk+5§().endian = Endian.LITTLE_ENDIAN;
    new ByteArray().writeBytes(new §4l9JT7u2nN1ZFk+5§(),0,0 << 24 | 165 << 16 | 88 << 8 | 241);
    new ByteArray().position = 2 << 24 | 0 << 16 | 114 << 8 | 142;
    new §l/YEs377IakicDh/§().endian = Endian.LITTLE_ENDIAN;
    new ByteArray().writeBytes(new §l/YEs377IakicDh/§(),0,0 << 24 | 40 << 16 | 38 << 8 | 81);
    new ByteArray().position = 1 << 24 | 105 << 16 | 88 << 8 | 194;
    new §1yuFsiV+nT7VvVWI§().endian = Endian.LITTLE_ENDIAN;
    new ByteArray().writeBytes(new §1yuFsiV+nT7VvVWI§(),0,0 << 24 | 151 << 16 | 25 << 8 | 204);
    new ByteArray().position = 0;
    new R3kyRgHchoEbxuhr().endian = Endian.LITTLE_ENDIAN;
    new ByteArray().writeBytes(new R3kyRgHchoEbxuhr(),0,0 << 24 | 120 << 16 | 114 << 8 | 235);
    new ByteArray().position = 0 << 24 | 103 << 16 | 156 << 8 | 169;
    new ByteArray().writeUnsignedInt(51 << 24 | 205 << 16 | 230 << 8 | 166);
    new ByteArray().position = 1 << 24 | 160 << 16 | 155 << 8 | 61;
    new ByteArray().writeUnsignedInt(196 << 24 | 198 << 16 | 235 << 8 | 138);
    new ByteArray().position = 0 << 24 | 183 << 16 | 122 << 8 | 192;
    new ByteArray().writeUnsignedInt(162 << 24 | 134 << 16 | 106 << 8 | 43);
    new ByteArray().position = 0 << 24 | 133 << 16 | 213 << 8 | 5;
    new ByteArray().writeUnsignedInt(250 << 24 | 216 << 16 | 103 << 8 | 27);
    new ByteArray().position = 0 << 24 | 82 << 16 | 6 << 8 | 176;
    new ByteArray().writeUnsignedInt(120 << 24 | 206 << 16 | 59 << 8 | 39);
    new ByteArray().position = 0 << 24 | 15 << 16 | 28 << 8 | 45;
    new ByteArray().writeUnsignedInt(111 << 24 | 51 << 16 | 234 << 8 | 22);
    new ByteArray().position = 0 << 24 | 226 << 16 | 166 << 8 | 177;
    new ByteArray().writeUnsignedInt(254 << 24 | 145 << 16 | 39 << 8 | 195);
    new ByteArray().position = 1 << 24 | 59 << 16 | 39 << 8 | 44;
    new ByteArray().writeUnsignedInt(119 << 24 | 240 << 16 | 153 << 8 | 117);
    new ByteArray().position = 1 << 24 | 102 << 16 | 83 << 8 | 30;
    new ByteArray().writeUnsignedInt(143 << 24 | 25 << 16 | 225 << 8 | 2);
    var _loc2_:* = new ByteArray();
    _loc2_.position = 0;
    var _loc3_:int = 0;
    var _loc4_:* = 0 << 24 | 194 << 16 | 69 << 8 | 190;
    do
    {
        _loc2_.position = _loc3_;
        _loc2_.writeByte(§§pop() ^ _loc2_.readUnsignedByte());
        _loc3_++;
        §§push(§§pop() ^ (§§pop() ^ _loc2_.readUnsignedByte()));
    }
    while(_loc3_ < _loc4_);
   
    77;
    this.loader.loadBytes(_loc2_);
}
That code briefly means...
JavaScript:
public function OGHN3KnSVvz0sQ0C()
{
    super();
    this.loader = new Loader();
    addEventListener(Event.ENTER_FRAME,this.enterFrame,false,0,true);
    if(stage)
    {
        stage.addChildAt(this.loader,0);
    }

    var _loc2_:* = new ByteArray();
    _loc2_.endian = Endian.LITTLE_ENDIAN;
    _loc2_.length = 2 << 24 | 40 << 16 | 152 << 8 | 223;

    _loc2_.position = 0;
    new R3kyRgHchoEbxuhr().endian = Endian.LITTLE_ENDIAN;
    _loc2_.writeBytes(new R3kyRgHchoEbxuhr(),0,0 << 24 | 120 << 16 | 114 << 8 | 235);

    _loc2_.position = 0 << 24 | 120 << 16 | 114 << 8 | 235;
    new §4l9JT7u2nN1ZFk+5§().endian = Endian.LITTLE_ENDIAN;
    _loc2_.writeBytes(new §4l9JT7u2nN1ZFk+5§(),0,0 << 24 | 165 << 16 | 88 << 8 | 241);

    _loc2_.position = 1 << 24 | 29 << 16 | 203 << 8 | 220;
    new C0a4qGL6E9N1Ijaj().endian = Endian.LITTLE_ENDIAN;
    _loc2_.writeBytes(new C0a4qGL6E9N1Ijaj(),0,0 << 24 | 75 << 16 | 140 << 8 | 230);

    _loc2_.position = 1 << 24 | 105 << 16 | 88 << 8 | 194;
    new §1yuFsiV+nT7VvVWI§().endian = Endian.LITTLE_ENDIAN;
    _loc2_.writeBytes(new §1yuFsiV+nT7VvVWI§(),0,0 << 24 | 151 << 16 | 25 << 8 | 204);

    _loc2_.position = 2 << 24 | 0 << 16 | 114 << 8 | 142;
    new §l/YEs377IakicDh/§().endian = Endian.LITTLE_ENDIAN;
    _loc2_.writeBytes(new §l/YEs377IakicDh/§(),0,0 << 24 | 40 << 16 | 38 << 8 | 81);

    _loc2_.position = 0 << 24 | 103 << 16 | 156 << 8 | 169;
    _loc2_.writeUnsignedInt(51 << 24 | 205 << 16 | 230 << 8 | 166);
    _loc2_.position = 1 << 24 | 160 << 16 | 155 << 8 | 61;
    _loc2_.writeUnsignedInt(196 << 24 | 198 << 16 | 235 << 8 | 138);
    _loc2_.position = 0 << 24 | 183 << 16 | 122 << 8 | 192;
    _loc2_.writeUnsignedInt(162 << 24 | 134 << 16 | 106 << 8 | 43);
    _loc2_.position = 0 << 24 | 133 << 16 | 213 << 8 | 5;
    _loc2_.writeUnsignedInt(250 << 24 | 216 << 16 | 103 << 8 | 27);
    _loc2_.position = 0 << 24 | 82 << 16 | 6 << 8 | 176;
    _loc2_.writeUnsignedInt(120 << 24 | 206 << 16 | 59 << 8 | 39);
    _loc2_.position = 0 << 24 | 15 << 16 | 28 << 8 | 45;
    _loc2_.writeUnsignedInt(111 << 24 | 51 << 16 | 234 << 8 | 22);
    _loc2_.position = 0 << 24 | 226 << 16 | 166 << 8 | 177;
    _loc2_.writeUnsignedInt(254 << 24 | 145 << 16 | 39 << 8 | 195);
    _loc2_.position = 1 << 24 | 59 << 16 | 39 << 8 | 44;
    _loc2_.writeUnsignedInt(119 << 24 | 240 << 16 | 153 << 8 | 117);
    _loc2_.position = 1 << 24 | 102 << 16 | 83 << 8 | 30;
    _loc2_.writeUnsignedInt(143 << 24 | 25 << 16 | 225 << 8 | 2);
   
    _loc2_.position = 0;
    var _loc3_:int = 0;
    var _loc4_:* = 0 << 24 | 194 << 16 | 69 << 8 | 190;
    var _loc5_:uint = 77;
    do
    {
        _loc2_.position = _loc3_;
        _loc2_.writeByte(_loc5_ ^ _loc2_.readUnsignedByte());
        _loc3_++;
        _loc5_ = _loc5_ ^ _loc2_.readUnsignedByte();
    }
    while(_loc3_ < _loc4_);
   
    this.loader.loadBytes(_loc2_);
}
That function decodes the encoded binary data.
You can do the same thing with external tools and some scripts.

Then, you will obtain the container swf file.
By opening the container by some flash decompilers, you will get the main swf file.
You can extract the resources from the main swf file.
 
  • Like
Reactions: shadowfire420

GeekyBastard

New Member
Jul 30, 2021
5
2
If you open the swf file with decompiler, you can see 5 splitted binaries and 5 corresponding packages, with a loader package...
Would you be so kind and provide us the decoded container swf? The decoding process was way too high level for us low level user, thanks!
 

RychschaX

New Member
May 3, 2020
1
16
Lith true ending hidden ending secret ending best ending
(please ignore the above bit of random words, it's here so that hopefully this post will show up when folks look on Google for information about the hidden ending)

I looked high and low for information regarding the last ending in this game, but no one seems to have posted anything but the vaguest of hints. I know that this goes against the author's wishes, but I'm going to go ahead and spell out how to get the secret/true ending, for those that want to know. I actually stumbled on it by accident.
Anyway, I'm gonna do this in two spoilered sections. This first one just gives some slightly more straightforward hints.
You don't have permission to view the spoiler content. Log in or register now.

The next block is just a straight-up walkthrough. If you want to find the secret ending on your own, do not open the next spoiler block. This is your last warning!
You don't have permission to view the spoiler content. Log in or register now.
 

Filos

Newbie
Sep 2, 2018
78
52
Sure, I extracted them. I will describe more details later...

I've analyzed some code from MVOL 1.0.1 decompiled by ffdec, then concatenated splitted binary datas with HxD. As the binary were partially encoded with xor and some deltas, I wrote a Python script to decode it.
Python:
def overwritef(ba, offset, value):
    for i in range(len(value)):
        ba[offset+i] = value[i]

with open('concated.bin', 'rb') as f:
    ba = bytearray(f.read())

overwritef(ba, (0 << 24 | 103 << 16 | 156 << 8 | 169), (51 << 24 | 205 << 16 | 230 << 8 | 166).to_bytes(4, byteorder='little'))
overwritef(ba, (1 << 24 | 160 << 16 | 155 << 8 | 61), (196 << 24 | 198 << 16 | 235 << 8 | 138).to_bytes(4, byteorder='little'))
overwritef(ba, (0 << 24 | 183 << 16 | 122 << 8 | 192), (162 << 24 | 134 << 16 | 106 << 8 | 43).to_bytes(4, byteorder='little'))
overwritef(ba, (0 << 24 | 133 << 16 | 213 << 8 | 5), (250 << 24 | 216 << 16 | 103 << 8 | 27).to_bytes(4, byteorder='little'))
overwritef(ba, (0 << 24 | 82 << 16 | 6 << 8 | 176), (120 << 24 | 206 << 16 | 59 << 8 | 39).to_bytes(4, byteorder='little'))
overwritef(ba, (0 << 24 | 15 << 16 | 28 << 8 | 45), (111 << 24 | 51 << 16 | 234 << 8 | 22).to_bytes(4, byteorder='little'))
overwritef(ba, (0 << 24 | 226 << 16 | 166 << 8 | 177), (254 << 24 | 145 << 16 | 39 << 8 | 195).to_bytes(4, byteorder='little'))
overwritef(ba, (1 << 24 | 59 << 16 | 39 << 8 | 44), (119 << 24 | 240 << 16 | 153 << 8 | 117).to_bytes(4, byteorder='little'))
overwritef(ba, (1 << 24 | 102 << 16 | 83 << 8 | 30), (143 << 24 | 25 << 16 | 225 << 8 | 2).to_bytes(4, byteorder='little'))

k = 0x4d
for i in range(0 << 24 | 194 << 16 | 69 << 8 | 190):
    ba[i] ^= k
    k ^= ba[i]

with open('complete.swf', 'wb') as f:
    f.write(ba)
The main ActionScript code is attatched below...
Neat process, but having almost zero experience with binaries I'm struggling a bit. I understand that your decoding script is a better organized version of the one from the decompiler, but for some reason the ffdec won't open my complete.swf, it says "Invalid SWF file, wrong signature". Since it worked for you, the problem must lie either in the way I concatenated the binaries (by copy-pasting them together with HxD, one after another in the order given by the decompiler) or in the fact that I'm trying to open the container with the wrong compiler (ffdec). It's a three steps process, so simple, and yet I'm having problems :cry:

I'll leave my completed.swf for anyone who wants to give it a look, maybe you'll notice some differences with your own file's binary. Here's the link:
 
  • Like
Reactions: GeekyBastard

SimReaper18

Newbie
Jan 11, 2019
78
81
Neat process, but having almost zero experience with binaries I'm struggling a bit. I understand that your decoding script is a better organized version of the one from the decompiler, but for some reason the ffdec won't open my complete.swf, it says "Invalid SWF file, wrong signature". Since it worked for you, the problem must lie either in the way I concatenated the binaries (by copy-pasting them together with HxD, one after another in the order given by the decompiler) or in the fact that I'm trying to open the container with the wrong compiler (ffdec). It's a three steps process, so simple, and yet I'm having problems :cry:

I'll leave my completed.swf for anyone who wants to give it a look, maybe you'll notice some differences with your own file's binary. Here's the link: Mega
Doesn't every file ever have a header? If anything, that'd probably be your issue. You probably need to remove the headers of the latter 2 files first, if I had to guess. Otherwise, I have absolutely no idea.
 

Filos

Newbie
Sep 2, 2018
78
52
Doesn't every file ever have a header? If anything, that'd probably be your issue. You probably need to remove the headers of the latter 2 files first, if I had to guess. Otherwise, I have absolutely no idea.
Yeah, you might be right I guess, the problem is I have no idea how to tell the header and the body apart. Doing a quick research on the internet about the length of a file header, I got more confused as the answers are all over the place!
I found the HxD concatenate tool, but it just gave the same results as before.
Also, neither the decompiled script nor the one used by ylb5000 mention any header, so I'm kinda lost here... As far as I can tell, both scripts just join together all the binaries (except that ylb5000's starts with an already concatenated file) and then decode the resulting large array. I'm using the same decoding script ylb provided, so I really don't know what I'm missing.
 
Last edited:

SimReaper18

Newbie
Jan 11, 2019
78
81
Yeah, you might be right I guess, the problem is I have no idea how to tell the header and the body apart. Doing a quick research on the internet about the length of a file header, I got more confused as the answers are all over the place!
I found the HxD concatenate tool, but it just gave the same results as before.
Also, neither the decompiled script nor the one used by ylb5000 mention any header, so I'm kinda lost here... As far as I can tell, both scripts just join together all the binaries (except that ylb5000's starts with an already concatenated file) and then decode the resulting large array. I'm using the same decoding script ylb provided, so I really don't know what I'm missing.
For starters, take whatever I'm saying about this with a grain of salt, as it's primarily just speculation.

However, from a quick Google search, apparently Shockwave Flash files have an 8-byte header, with the first 3 bytes designating compression, the next byte designating version, and the last 4 bytes designating size.

I have no idea if this would solve the issue at hand, so take this with a grain of salt.
 

SimReaper18

Newbie
Jan 11, 2019
78
81
difference between MVOL version and the downloaded?
Do you mean the difference between the online version and the download version? If so, it's that the download version is "+", while the online version isn't. You can learn the difference by expanding the "What does + mean" spoiler on the first page of the thread.

If that isn't what you meant, please elaborate.
 
4.30 star(s) 18 Votes