Back Story:
In the next few days I will be releasing an update for my TypeX2 multi that adds a number of new features. One of those features is support for Taito's best protection to date! Known as "[T]ype [X] en[C]rypted [E]xe" or TXCE for short. The TXCE protection is pretty interesting as only certain portions of a game's executable is actually encrypted and these encrypted areas are decrypted in memory when the game starts.
The way the process works is like this. Each TXCE protected game is accompanied by a "game.dat" file. The game.dat file is actually three different files concatenated together and then encrypted. These files include a library, and two binary files known as "RCODE" and "RPARAM" and are responsible for decrypting the game. In a simplified explanation, whatever wants to launch the game needs to start the game in a suspended state, decrypt the game.dat file, inject the library, write the RCODE to process memory and finally pass the RPARAM before resuming the game process.
Sounds simple enough right? Well yea, in theory the whole process isn't very complicated. The problem however, is the decryption routine for the game.dat files. In order to protect the process, Taito used a technique to obscure the machine code making it EXTREMELY difficult to reverse engineer.
To date, only a few Type
X2 games actually used the TXCE protection. It was mainly used to protect deluxe games that where far better protected by their dependency of ridiculously rare and obscure I/O boards and sensors.
The Problem:
In the past, before I entered the scene. Games protected with TXCE where "decrypted" by dumping the game process out of memory while it was running and overwriting the encrypted areas with those from the memory dump. While this process certainly works, its not ideal. We have no idea if the data pulled from memory was good, and we have no way of verifying the game executable wasn't tampered with.
As you've probably deduced by now, one of the games utilizing the TXCE protection is BlazBlue CS2. Which was "decrypted" using the process mentioned above.
The Solution:
Earlier this year, I developed tools for working with TXCE protected games and a clean solution for running them. My solution involves dumping the library, and RCODE/RPARAM binaries once the official launcher decrypts them. Then using them to decrypt the games at runtime just like Taito intended. This solution allows us to keep everything clean and run unmodified game code that can easily be verified by the MD5 sum included with each game executable.
Now for the difficult part, obtaining a BlazBlue CS2 drive and dongle. There where only 50 units ever produced and they where expensive. However I've been able to track down a complete kit thats available for purchase for $1500 USD.
The Goal:
To obtain a clean dump of BBCS2 along with dumping the TXCE library, and RCODE/RPARAM binaries.
Once the kit is obtained the following will happen.
1.) Pictures will be taken of everything for documentation
2.) The drive will be imaged
3.) a 1:1 clone drive will be made so I can cleanly extract the needed files without having to touch the legit drive.
4.) Everything will be released publicly for preservation.
Ultimately what I'd like to do is run a group buy in order to purchase the kit.
At this point I just want to gauge interest and get some feedback. If enough people show interest then I'll start collecting money and get the ball rolling.
If you do show interest now but something comes up and you need to back out before money is collected. There will be no hard feelings, and no questions asked. Just let me know.
Backers:
1.) Niko: $200 + Taxes + Shipping costs
2.) rtw: $100 ( Paid ) ( refunded )
3.) PascalP: $50 ( Paid ) ( refunded )
4.) ekorz: $100 ( Paid ) ( refunded )
5.) Yippikaye: $50 ( Paid ) ( refunded )
6.) ThisGuy: $50 ( Paid ) ( refunded )
7.) deibit: $50 ( Paid ) ( refunded )
8.) twistedsymphony: $50 ( Paid ) ( refunded )
9.) jugu: $60 ( Paid ) ( refunded )
10.) SNK-NEO-GEO: $100 ( Paid ) ( refunded )
11.) Magus Incognito: $50 ( Paid ) ( refunded )
X.) nam9: $Dank Meme
12.) Darksoft: $50 ( Paid ) ( refunded )
13.) Tom5151: $40 ( Paid ) ( refunded )
14.) Outside of Time: $40 ( Paid ) ( refunded )
15.) Derick2k: $200 ( Paid ) ( refunded )
16.) Corey: $100 ( Paid ) ( refunded )
17.) waiwainl: $20 ( Paid ) ( refunded )
18.) sammargh: $50 ( Paid ) ( refunded )
19.) Gakman: $10 ( Paid ) ( refunded )
20.) Bleedo: $130 ( Paid ) ( refunded )
....
Total: $1500 / $1500
In the next few days I will be releasing an update for my TypeX2 multi that adds a number of new features. One of those features is support for Taito's best protection to date! Known as "[T]ype [X] en[C]rypted [E]xe" or TXCE for short. The TXCE protection is pretty interesting as only certain portions of a game's executable is actually encrypted and these encrypted areas are decrypted in memory when the game starts.
The way the process works is like this. Each TXCE protected game is accompanied by a "game.dat" file. The game.dat file is actually three different files concatenated together and then encrypted. These files include a library, and two binary files known as "RCODE" and "RPARAM" and are responsible for decrypting the game. In a simplified explanation, whatever wants to launch the game needs to start the game in a suspended state, decrypt the game.dat file, inject the library, write the RCODE to process memory and finally pass the RPARAM before resuming the game process.
Sounds simple enough right? Well yea, in theory the whole process isn't very complicated. The problem however, is the decryption routine for the game.dat files. In order to protect the process, Taito used a technique to obscure the machine code making it EXTREMELY difficult to reverse engineer.
To date, only a few Type
X2 games actually used the TXCE protection. It was mainly used to protect deluxe games that where far better protected by their dependency of ridiculously rare and obscure I/O boards and sensors.The Problem:
In the past, before I entered the scene. Games protected with TXCE where "decrypted" by dumping the game process out of memory while it was running and overwriting the encrypted areas with those from the memory dump. While this process certainly works, its not ideal. We have no idea if the data pulled from memory was good, and we have no way of verifying the game executable wasn't tampered with.
As you've probably deduced by now, one of the games utilizing the TXCE protection is BlazBlue CS2. Which was "decrypted" using the process mentioned above.
The Solution:
Earlier this year, I developed tools for working with TXCE protected games and a clean solution for running them. My solution involves dumping the library, and RCODE/RPARAM binaries once the official launcher decrypts them. Then using them to decrypt the games at runtime just like Taito intended. This solution allows us to keep everything clean and run unmodified game code that can easily be verified by the MD5 sum included with each game executable.
Now for the difficult part, obtaining a BlazBlue CS2 drive and dongle. There where only 50 units ever produced and they where expensive. However I've been able to track down a complete kit thats available for purchase for $1500 USD.
The Goal:
To obtain a clean dump of BBCS2 along with dumping the TXCE library, and RCODE/RPARAM binaries.
Once the kit is obtained the following will happen.
1.) Pictures will be taken of everything for documentation
2.) The drive will be imaged
3.) a 1:1 clone drive will be made so I can cleanly extract the needed files without having to touch the legit drive.
4.) Everything will be released publicly for preservation.
Ultimately what I'd like to do is run a group buy in order to purchase the kit.
At this point I just want to gauge interest and get some feedback. If enough people show interest then I'll start collecting money and get the ball rolling.
If you do show interest now but something comes up and you need to back out before money is collected. There will be no hard feelings, and no questions asked. Just let me know.
Backers:
1.) Niko: $200 + Taxes + Shipping costs
2.) rtw: $100 ( Paid ) ( refunded )
3.) PascalP: $50 ( Paid ) ( refunded )
4.) ekorz: $100 ( Paid ) ( refunded )
5.) Yippikaye: $50 ( Paid ) ( refunded )
6.) ThisGuy: $50 ( Paid ) ( refunded )
7.) deibit: $50 ( Paid ) ( refunded )
8.) twistedsymphony: $50 ( Paid ) ( refunded )
9.) jugu: $60 ( Paid ) ( refunded )
10.) SNK-NEO-GEO: $100 ( Paid ) ( refunded )
11.) Magus Incognito: $50 ( Paid ) ( refunded )
X.) nam9: $Dank Meme
12.) Darksoft: $50 ( Paid ) ( refunded )
13.) Tom5151: $40 ( Paid ) ( refunded )
14.) Outside of Time: $40 ( Paid ) ( refunded )
15.) Derick2k: $200 ( Paid ) ( refunded )
16.) Corey: $100 ( Paid ) ( refunded )
17.) waiwainl: $20 ( Paid ) ( refunded )
18.) sammargh: $50 ( Paid ) ( refunded )
19.) Gakman: $10 ( Paid ) ( refunded )
20.) Bleedo: $130 ( Paid ) ( refunded )
....
Total: $1500 / $1500
Last edited:
(I'll add the AES version coming soon too)
