Decrypt an encrypted esp file

[whitecode]

I didn't even know that esp can be encrypted

So there is this private work that provides custom mods, I think its pretty neat so I supported it, but the son of a bitch author has the guts to encrypt the esp so no one could edit it

xedit can't load it, loot won't recognize it (which messes up vortex), and CK will display it as blank esp

If I want to play with the mod I had to load a program he provided to me first before starting the game

Does anyone know how to decrypt such thing?

(I will provide the esp and the program through private if anyone is interested to see)

[Mauserl]

But it works if put into the Load Order? Now I'm curious ...

 

Caveat though: I don't even think this should be possible. Anyone able to pull this off could also easily use it to infect your system with malware.

Edited July 21, 2021 by Mauserl

[Uncle64]

If you run in to one like that.

Post the link to the page you have downloaded it from if it is Nexus or here.

 

The esp can be blank if it is one placeholder. But we do need more information.

[Mister X]

Never heard of anything like that before, but maybe the program you have to load is the decryption tool. Even though I wouldn't want to start anything like that, if it's only one person who uses that.

 

Tbh I can imagine that Bethesda or Microsoft put something like that officially into their next games though, when they keep their "making money by mods" thingy they started with Skyrim SE.

So mod authors who want to make money would be able to encrypt their .esp or .bsa files with official provided stuff (eg. CK and Archive.exe) so the assets can't be stolen anymore and only the game itself would be able to decrypt it on runtime.

That would bring a hell load of Reverse Engineering to the SKSE team, if they even would be willing to try and break that encryption.

Edited July 21, 2021 by Mister X

[belegost]

2 hours ago, whitecode said:

If I want to play with the mod I had to load a program he provided to me first before starting the game

 

That sounds sketchy as hell. I wouldn't trust anyone who does this, even if they swear to God Almighty this is "Perfectly And Totally Safe, Trust Me (tm)". To me it looks like some kind of elaborate scam. Run several different anti-viruses on that mod file and the program that person provides just in case.

Edited July 21, 2021 by belegost

[RomeoZero]

Where is the ESP ? I'm interested to look at it for scientific purposes.  

[whitecode]

On 7/21/2021 at 4:44 PM, Uncle64 said:

If you run in to one like that.

Post the link to the page you have downloaded it from if it is Nexus or here.

 

The esp can be blank if it is one placeholder. But we do need more information.

 

On 7/21/2021 at 5:38 PM, Mister X said:

Never heard of anything like that before, but maybe the program you have to load is the decryption tool. Even though I wouldn't want to start anything like that, if it's only one person who uses that.

 

Tbh I can imagine that Bethesda or Microsoft put something like that officially into their next games though, when they keep their "making money by mods" thingy they started with Skyrim SE.

So mod authors who want to make money would be able to encrypt their .esp or .bsa files with official provided stuff (eg. CK and Archive.exe) so the assets can't be stolen anymore and only the game itself would be able to decrypt it on runtime.

That would bring a hell load of Reverse Engineering to the SKSE team, if they even would be willing to try and break that encryption.

 

On 7/21/2021 at 6:36 PM, RomeoZero said:

Where is the ESP ? I'm interested to look at it for scientific purposes.  

 

Hi guys, really sorry I just ditched this thread back then, kinda just rage quitted at the spot (thought of graduating from Skyrim anyways)

If any of you are still interested in the encryption I'll provide the esps down below, I won't give the program they gave for decryption unless anyone really wants it (message me in private), a heads warning that its developed by Chinese.

 

Basically these mods are a massive quality fem overhaul of skyrim, if anyone is interested and able to crack it I will share it some way

 

ZZZ_7xxGirlSkyirm_LadyFix.esp ZZZ_7xxGirlSkyirm_NordMale_ALL.esp ZZZ_7xxGirlSkyirm_RedGuard.esp ZZZ_7xxGirlSkyirm_SPNPC.esp ZZZ_7xxWickedSevenGirlSkyirm.esm ZZZ_7xxGirlSkyirm_000BaseNPC.esp ZZZ_7xxGirlSkyirm_001BaseJH.esp ZZZ_7xxGirlSkyirm_Breton.esp ZZZ_7xxGirlSkyirm_Imperial.esp

[Mister X]

Small question: do you have to decrypt them for the game to recognize?

Or does the game handle them correctly in the encrypted state?

[whitecode]

29 minutes ago, Mister X said:

Small question: do you have to decrypt them for the game to recognize?

Or does the game handle them correctly in the encrypted state?

 

If you load the esp without the author's outside program running then you will CTD when loading the game, if the program is currently running then the mod will work normally.

The author's program looked like this

 

[Mister X]

Sounds weird to me. Why not simply using a password secured 7z / zip folder?

[Tlam99]

13 minutes ago, whitecode said:

program running

All time running  ?????

at least block it with the firewall.

 

[whitecode]

13 minutes ago, Tlam99 said:

All time running  ?????

at least block it with the firewall.

 

yea that way I can't use the mod, didn't try to close it midway in game though

That's why this thing is so strange, if you try to open the esp with editors it will display as a blank esp

[mircislav]

19 minutes ago, whitecode said:

yea that way I can't use the mod

Looks like you will end up reformatting your HDD's...

[izomiac]

It looks like the ESP doesn't have a TES4 header, so the whole file is probably encrypted rather than being some obscure format that the vanilla Skyrim engine can interpret.  There are two ways I can see it working:

1. The program does a runtime patch of the Skyrim engine to add a decryption method to the plugin loader.  This requires a moderate level of programming expertise and a decent amount of time to reverse engineer, making it generally not worth the effort.  It would also require the decryption program to be updated for every version of Skyrim, which would require even more effort on the mod author's part than a would-be cracker's, so I doubt this method was used.
2. The program decrypts the file to a temporary directory (or virtual filesystem) and when Skyrim tries to open the encrypted .esp the decrypted version is accessed instead.  Similar to how Mod Organizer works.

The second method may be fairly easy to circumvent.  First start Process Explorer.  Next start the decryption program and Skyrim.  Alt-tab back to Process Explorer and examine Skyrim's and the decryption program's file handles.  One should point to an .esp in an unusual location, like a temporary directory.

 

Another sneaky thing you can do is to replace SkyrimSE.exe with a third party file manager.  Then browse to your Data folder and copy the decrypted .esp out of there.

 

Oh, and assume that decryption program installed a rootkit on your machine.  DRM authors have historically lacked ethics, and some random Chinese modder has no realistic chance of being held accountable for doing sketchy crap.  This might also be why you can't decrypt it -- a rootkit might be actively preventing you from reading the file.