Error: Can't dump bytes to array.

[WaGi-Coding]

Tried to get the key for "Medieval Dynasty" but it does not work :( The game uses 4.25.3

[allcoolthingsatoneplace]

pattern where kay is stored doesn't match need to scout his manually with HxD

[muyanali]

hello how to get the initPattern, my game initPattern is not \x48\x8D\x41\x1F\xC7\x45\xD8

[muyanali]

initPattern Is it related to the game engine version, or is it customized by the developer?

[allcoolthingsatoneplace]

its unique for each machine it installed on, so if u will build multiple games on ur machine it will carry same pattern, but if u will assemble same project on other hardware it would be different.. Get Outlook for Android<https://aka.ms/AAb9ysg>

…

________________________________ From: soulofcode ***@***.***> Sent: Tuesday, August 31, 2021 12:56:21 PM To: allcoolthingsatoneplace/dumpPakKey ***@***.***> Cc: allcoolthingsatoneplace ***@***.***>; Comment ***@***.***> Subject: Re: [allcoolthingsatoneplace/dumpPakKey] Error: Can't dump bytes to array. (#4) initPattern Is it related to the game engine version, or is it customized by the developer? — You are receiving this because you commented. Reply to this email directly, view it on GitHub<#4 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AQMZG7H2AOXTI7LJHJQMAFLT7SRMLANCNFSM4RSQTOPA>. Triage notifications on the go with GitHub Mobile for iOS<https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android<https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[muyanali]

The UE4demo I built on my machine has the same pattern as your code, but the other UE4 game I downloaded did not have this pattern when I searched its binary file. Are there any keywords to search and locate it.

[muyanali]

Or how did you locate this initPattern is \x48\x8D\x41\x1F\xC7\x45\xD8, use xdbg breakpoint debugging?

[allcoolthingsatoneplace]

this one, was scouted with only HxD, but for others u need to search AES returning function, heres an article, it will give u an idea of how to: https://stillu.cc/infosec/2021/03/01/obtaining-unreal-pak-decryption-key/ enjoy. Get Outlook for Android<https://aka.ms/AAb9ysg>

…

________________________________ From: soulofcode ***@***.***> Sent: Tuesday, August 31, 2021 4:01:31 PM To: allcoolthingsatoneplace/dumpPakKey ***@***.***> Cc: allcoolthingsatoneplace ***@***.***>; Comment ***@***.***> Subject: Re: [allcoolthingsatoneplace/dumpPakKey] Error: Can't dump bytes to array. (#4) Or how did you locate this initPattern is \x48\x8D\x41\x1F\xC7\x45\xD8, use xdbg breakpoint debugging? — You are receiving this because you commented. Reply to this email directly, view it on GitHub<#4 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AQMZG7HSR5IIWRWOJJV2WJLT7THCXANCNFSM4RSQTOPA>. Triage notifications on the go with GitHub Mobile for iOS<https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android<https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[muyanali]

ok Thanks for your answer!

[allcoolthingsatoneplace]

little edit, cuz was replyed on the fly to maje things clear, that pattern is not a code it self, its just a section, this section stored around that region where the key is divided, so this section is not unique, unique is they key that stored around it and divided with 4 bytes those 4 bytes can be unique, but if u had success to run it down on ur local project means its not unique too mb in some cases.. but chunks of key stored in between is unique its hex(bytes) from ur base64 key section in project settings encryption.. Get Outlook for Android<https://aka.ms/AAb9ysg>

…

________________________________ From: soulofcode ***@***.***> Sent: Tuesday, August 31, 2021 7:10:49 PM To: allcoolthingsatoneplace/dumpPakKey ***@***.***> Cc: allcoolthingsatoneplace ***@***.***>; Comment ***@***.***> Subject: Re: [allcoolthingsatoneplace/dumpPakKey] Error: Can't dump bytes to array. (#4) ok Thanks for your answer! — You are receiving this because you commented. Reply to this email directly, view it on GitHub<#4 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AQMZG7CF7PVSP6OLCBMERGLT7T5ITANCNFSM4RSQTOPA>. Triage notifications on the go with GitHub Mobile for iOS<https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android<https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[allcoolthingsatoneplace]

and second point is that those reliese builds have something above this "standard" mb they some how modify something in code it self, this needs to be researched. each AES key is unique on those reliases like in fortnite for example, each time each patch comes with different AES pak key, and its not the same as in this POC thing i made.. so thats why u need to research AES key with x64dbg from memory... !) Get Outlook for Android<https://aka.ms/AAb9ysg>

…

________________________________ From: unknown unknown ***@***.***> Sent: Wednesday, September 1, 2021 10:05:09 AM To: allcoolthingsatoneplace/dumpPakKey ***@***.***> Subject: Re: [allcoolthingsatoneplace/dumpPakKey] Error: Can't dump bytes to array. (#4) little edit, cuz was replyed on the fly to maje things clear, that pattern is not a code it self, its just a section, this section stored around that region where the key is divided, so this section is not unique, unique is they key that stored around it and divided with 4 bytes those 4 bytes can be unique, but if u had success to run it down on ur local project means its not unique too mb in some cases.. but chunks of key stored in between is unique its hex(bytes) from ur base64 key section in project settings encryption.. Get Outlook for Android<https://aka.ms/AAb9ysg>

________________________________ From: soulofcode ***@***.***> Sent: Tuesday, August 31, 2021 7:10:49 PM To: allcoolthingsatoneplace/dumpPakKey ***@***.***> Cc: allcoolthingsatoneplace ***@***.***>; Comment ***@***.***> Subject: Re: [allcoolthingsatoneplace/dumpPakKey] Error: Can't dump bytes to array. (#4) ok Thanks for your answer! — You are receiving this because you commented. Reply to this email directly, view it on GitHub<#4 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AQMZG7CF7PVSP6OLCBMERGLT7T5ITANCNFSM4RSQTOPA>. Triage notifications on the go with GitHub Mobile for iOS<https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android<https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[muyanali]

okay，I&nbsp; Have&nbsp; got&nbsp; the&nbsp; AES&nbsp; key,&nbsp;&nbsp;Thanks&nbsp; sharing!

…

------------------&nbsp;原始邮件&nbsp;------------------ 发件人: ***@***.***&gt;; 发送时间: 2021年9月1日(星期三) 下午3:12 收件人: ***@***.***&gt;; 抄送: ***@***.***&gt;; ***@***.***&gt;; 主题: Re: [allcoolthingsatoneplace/dumpPakKey] Error: Can&#39;t dump bytes to array. (#4) and second point is that those reliese builds have something above this "standard" mb they some how modify something in code it self, this needs to be researched. each AES key is unique on those reliases like in fortnite for example, each time each patch comes with different AES pak key, and its not the same as in this POC thing i made.. so thats why u need to research AES key with x64dbg from memory... !) Get Outlook for Android<" rel="noopener" target="_blank">https://aka.ms/AAb9ysg&gt;; ________________________________ From: unknown unknown ***@***.***&gt; Sent: Wednesday, September 1, 2021 10:05:09 AM To: allcoolthingsatoneplace/dumpPakKey ***@***.***&gt; Subject: Re: [allcoolthingsatoneplace/dumpPakKey] Error: Can't dump bytes to array. (#4) little edit, cuz was replyed on the fly to maje things clear, that pattern is not a code it self, its just a section, this section stored around that region where the key is divided, so this section is not unique, unique is they key that stored around it and divided with 4 bytes those 4 bytes can be unique, but if u had success to run it down on ur local project means its not unique too mb in some cases.. but chunks of key stored in between is unique its hex(bytes) from ur base64 key section in project settings encryption.. Get Outlook for Android<" rel="noopener" target="_blank">https://aka.ms/AAb9ysg&gt;; ________________________________ From: soulofcode ***@***.***&gt; Sent: Tuesday, August 31, 2021 7:10:49 PM To: allcoolthingsatoneplace/dumpPakKey ***@***.***&gt; Cc: allcoolthingsatoneplace ***@***.***&gt;; Comment ***@***.***&gt; Subject: Re: [allcoolthingsatoneplace/dumpPakKey] Error: Can't dump bytes to array. (#4) ok Thanks for your answer! — You are receiving this because you commented. Reply to this email directly, view it on GitHub<" rel="noopener" target="_blank">#4 (comment)&gt;;, or unsubscribe<" rel="noopener" target="_blank">https://github.com/notifications/unsubscribe-auth/AQMZG7CF7PVSP6OLCBMERGLT7T5ITANCNFSM4RSQTOPA&gt;;. Triage notifications on the go with GitHub Mobile for iOS<" rel="noopener" target="_blank">https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&amp;mt=8&amp;pt=524675&gt;; or Android<" rel="noopener" target="_blank">https://play.google.com/store/apps/details?id=com.github.android&amp;referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub&gt;;. — You are receiving this because you commented. Reply to this email directly, view it on GitHub, or unsubscribe. Triage notifications on the go with GitHub Mobile for iOS or Android.