Isn’t the drive encrypted?

This has me very intrigued. Going to mess with this later today.

This is the first time I'm seeing this. Has anyone figured this out? I'll take a look when I have moment tomorrow. Shouldn't be too hard to pack the iso back up.

Some new videoclips with Jack Sparrow would be nice - looking forward to seeing what the community will accomplish.

The assets have been encrypted with Sentinel License Manager since an update to WOZ a few years back. However, you may be able to generate your own update ZIP file and overwrite encrypted asset files with new unencrypted ones. Last I checked there are no integrity checks when importing update ZIP files.

https://pinside.com/pinball/forum/topic/wizard-of-oz-new-code-coming-soon#post-2718492

Game changer for Wonka if this can be done. Hell even pirates. Fingers crossed.

Well I guess code can't be updated for Wonka so maybe not game changer but would be awesome!

Not possible. Even if you could generate your own update zip you'd have no idea what asset to replace, the format, the audio format, etc.

It’s possible with WOZ (I and others have done it). Various videos are stored in FLV format, the audio is stored in uncompressed WAV PCM format at 44100Hz. And I believe images are in PNG format. The file hierarchy should be viewable, the files themselves are just encrypted.

I tried earlier this year but was hit with the encryption. If anyone figures it out I'd be crazy excited. I just need some original music...

How far did you get? How did you mount the volume?

Aound 15 years ago there was a lawsuit filed against satellite companies. People were hacking the cards to get free service. The companies started pushing out their code to stop this. A Federal judge ruled that once you buy the product, it is yours and you have the freedom to do as you wish with it and the company has no right to stop you.
I suggest submitting a ticket asking for an image where ONLY the video and audio library files are not encrypted. They could easily leave the OS files encrypted and you wouldnt brick the machine. Explain what you're wanting to accomplish.
I cant see any reason why JJP couldn't do this for "developers".

Last night I downloaded the ISO mounted it and force extracted the install package. I don't think it's encrypted because I saw file names float through like JackSparrow.wav etc. I think this works the same was as imaging an SD card for installation on a Raspberry PI.
I only spentlike 15 minutes on it last night because it was late, but I'm going to dive in hard tonight and see where I can get.

It might be simpler than that though... the game itself is run off of a regular Motherboard with a Solid State Drive. You might just be able to just go straight to the games drive and find the files. (My machine won't be here until next week so I can't test the theory until then.)

I'll keep everyone posted.

If you're just looking for music check this out... https://www.amazon.com/gp/product/B07KPR9DXB/ref=ppx_yo_dt_b_asin_title_o00_s00

It is powered by the Aux USB port and hooks right into your speakers, or another 15$ speaker if you like. It's a 6$ board that Marc Chytracek
on the Facebook group "Pinball Enthusiasts" posted about. He rigged it to play sea and ship sounds through play and the theme song when the game boots up.

I am VERY interested in learning how to do that on WOZ. Is there a tutorial somewhere, or any chance to get the infos on how to do that ?

I dont want to change too many things, all I want is to change the no lyrics musics, sotr typically. I really miss Judy Garland’s voice.

i can confirm this. This is also true for Hobbit, and I do not believe there are encryption integrity checks.

I’ve totally forgotten how to drop to the CLI on boot up for Pirates

Ok Folks.... it was complicated but I was able to extract out all of the data in the package. It's not encrypted, and easily modded. I'll post my process when I get a chance. Next steps are modding the files and packing the .iso back up to be installed. Modding looks like just swapping out current files with new ones.

Basically you need a linux machine to unpack all the data... and the process is complicated, but not too bad if you're familiar with this sort of thing.

Good news is I cracked it with a raspberry pi - so anyone should be able to do what I did.

I'll write up a doc this weekend and post it once I've completed the process.

JJP_install_complete (resized).png

KILLER! we can put some of that pirates soundtrack in the game finally..

And like actual voices and sound clips from the movies. I'm gonna Depp-afy the heck out of this thing.

There is no official tutorial due to the encryption, but nobody has tried this in the last few years since. Considering Patrickkrebs found JJP has reversed their decision on encryption, I will wait for his guide.

This is huge. Awesome

OMG....this is HUGE! I don't know Linux at all, but if you guys are able to mod out the software in this game it will make this game truly great.

subscribed

Ok here is where I got last night

Basically the downloaded .Iso can be mounted then all of the data sits in a spanned .gz archive.

You have to 'sudo apt install partimage' (this requires linux, couldn't find an OSX work around or a PC work around because clonezilla (which made the archive) is basically it's own linux based operating system run from a thumbdrive.

You use 'cat sda1.ext4-ptcl-img.gz.a* | gzip -d -c > sda1.img' - to turn the images into a single archive.

Then run...

partclone.extfs -r -s sda1.img -o sda1-restore.img --restore_raw_file

You'll then be able to mount the sda1-restore.img and see all of the files in the file system as they would be on the pinball machine itself. All of the game assets are in a folder called jjpe or pirates (dont have my laptop with me at work right now) There are a TON of .wav .png .flv files

That's as far as I got.... i tried transferring some of the .wav .flv and .png files over but they would not open on my Mac.

This might be where the "encryption" thing kicks in. (But I doubt it I think there is just a translation error between Linux and OSX I need to work through)

But that's currently where I'm at.
If you have questions let me know and I'd be happy to have more hands and brains on this!

Unfortunately that is the Sentinel License Manager encryption. OSX can open PNG files by default. That’s as far as we can go with this. This confirms my last experience with WOZ. A known plaintext attack could work using the file headers, but the first few bytes of multiple PNG files (IE) are different. This probably means a unique private key is used for each file.

https://sentinelldk.gemalto.com/LDKdocs/SPNL/LDK_SLnP_Guide/Distributing/License_Manager/010-License_Manager-intro.htm

We really should petition JJP to open up the assets to add value to peoples’ games who want to do this. The last time I checked, CGC does not encrypt their assets. However, they may do this at the requirement of the license holders. If that’s the case, why not allow unencrypted files to replace the encrypted ones? Hobbyists don’t need to read the original files, just replace them.

On that note, please try this with Dialed In. It’s an original game and should have no real reason to use encryption of the assets.

Damnit, I think that's where I got stuck too. I'll sign any petition on this issue, we don't have to worry about this with cheaper Sterns and we paid quite a bit more for JJ's.

We need real hackers in pinball. XD

This is all great information Crash. Thank you. I'm going to keep cracking and updating as I go.

Sure. You can try replacing an encrypted file with a non encrypted one and see if it works. Or, download the latest delta patch ZIP file for the game and replace one of the encrypted files. Last I checked there are no integrity checks on the contents of ZIP files.

No kidding, I'll be checking this thread several times a day to see what you find.

Good work guys. I'm very intrigued by this

Probably a license issue as all of a sudden someone's license is being represented in an inappropriate way. I could see someone putting clips from another certain Pirates series into POTC lol.

Bad news guys.... the encryption thing was correct, none of the .png .flv or .wav files are unusable.
I don't know how they're encrypted/decrypted.
Sorry for getting everyone's hopes up.

You could also rebuild new versions of the underlying audio and visual playback functions by the operating system and replace assets that way. I am guessing the source code for those are open source. Once these calls are intercepted, you can catalog the signatures of the assets and map them to their replacements to be triggered on playback.

The encryption is protecting the licensed assets. I would suggest trying to replace them instead of modifying them. Also, the machine has to be able to decrypt the licensed assets, which means the key is somewhere. Do JJP machines have a dongle in one of the USB ports? That’s an old school way of protecting a key, and making it more difficult to clone a machine. The encrypted data is passed to the fob for decryption; the key itself is never exposed.

Yep, the games have USB keys. Any way to copy the key off of it? I don't know

https://pinside.com/pinball/forum/topic/whats-the-purpose-of-the-jjp-usb-dongle

They’re designed to make it extremely difficult. They have an anti-tamper mechanism that zeroes out the key if you try to open the fob.

One of the techniques requires the use of liquid nitrogen to freeze the fob, giving you enough time to open it and disable the anti-tamper.

The other attack vector is going after the data after it’s been decrypted. If it’s being displayed (images, etc), it’s in RAM.

Ok, interesting stuff. I downloaded the Dialed In 1.71 delta ZIP file and started looking at the files in a hex editor.

files (resized).png

A common approach to an attack is to look for patterns and use a frequency analysis to line up common pattern in the ciphertext with pattern in a known plaintext source, and go from there. I started with a WAV file because they have predictable patterns from the oscillating waves they are reproducing. Fortunately, no compression is used, so these repeating characteristics are easy to look for in the ciphertext. Here is the ASCII section of my hex editor viewing one of the WAV files. See the oscillating pattern in the bytes?

pattern1 (resized).png

When I saw this I thought the encryption was pretty weak, since I could see a clear pattern in the encrypted data. I loaded a couple files in Audacity and can tell you right now the encryption is pretty good, and shows no patterns in the encrypted data. However, something really surprised me. See this?

ramp (resized).png

The file is only partially encrypted! This means plaintext replacement files in theory could be used to mod these games. The encrypted portion of the sound is pure white noise. The unencrypted portion is the word "ramp" at the end of the sentence "Shoot the left ramp!" followed by this string of text:

INFOISFT8...Lavf57.25.100 (libsndfile-1.0.24);Sound Forge Pro 10.0..id3 [email protected] (libsndfile-1.0.24);Sound Forge Pro 10.0

Neat, the files were mastered in Sound Forge Pro. As for the encryption, now I'm wondering why the file is not fully encrypted. Actually, multiple files are not fully encrypted! Check this out. I imported the encrypted music file and compared it to "Shoot the left ramp." And look, only the same amount of data is encrypted every time!

music (resized).png

So I counted how many bytes of encrypted data we have, which is 131,072 bytes (128KB). This either means the key is 128KB long and only used once (not padded/repeated), or the key is smaller than this and only padded a few times. This leads me to believe that once the security dongle is finished decrypting the 128KB chunk of ciphertext data, it simply reads the rest of the file back to the game program unaltered. The music is the JJP logo intro audio.

Next I will try decoding one of the PNG files past the initial 128KB section of the file and post what I find.

Here is what we found out today....
Disparate facts in no necessary order:

- Dailed in is different from the movie property games.

- Pirates is literally based on WOZ - all of the .sh script code all still even says WOZ in it. The code even gives credit to the WOZ coder from 2015 and sites a new person who changed a couple of directory names as an editor later for the pirates game.

-All of the media files have an encryption method. The encryption/decryption methods and functions are embedded in the binary that is run at game time with flags after boot-up. So if certain checks are passed the boot scripts run "./game -p"

-The file "game" is a binary c compiled executable; being such I'm not proficient enough to decompile or backwards engineer the hex code to be able to see how the media files are manipulated.

-We logic'ed the the media files were themselves hex Code that had an algorithm run on them and then shifted. <----based on crash's findings maybe we were wrong.

-The only way any of there .png files were viewable, was if you saved them out as plain text files and viewed them as hexadecimal code. We did not try to view the audio in an audio editor like crash... but we will certainly try this tomorrow to confirm or deny the existence of the same kind of header he's seeing in Dialed-in.

-Before me and my buddy broke for the night we decided the full files could not be completely encrypted - because the i3 processor with 8 gigs of ram running this thing has no way of decrypting a movie file, let alone an audio file - on the fly during game play. It just didn't make sense.

Crash's data is interesting and refreshing because it proves a method within the capacity of the hardware to actually decode the files on the fly, without having to fully decode the files, its simply having to identify the right combo of data to truncate - which would be a pretty inexpensive processing function.

Anyway.... if someone is brave enough to create a new audio file that has different audio after this mark in the audio - it looks like theoretically it should work.

Screen Shot 2019-08-30 at 1.56.23 AM (resized).png

This doesn't surprise me, as JJP would have to go to the extra cost and effort to modify their production lines to use non-encrypted PCs for Dialed In.

The decryption is not happening in software, it is accelerated by the Sentinel HASP HL security dongle. The dongle receives the ciphertext and decrypts it in real time. Can someone with a JJP game see if their dongle is any if the below models?

https://sentinel.gemalto.com/software-monetization/sentinel-hasp-hl/

Not even that, really. The amount of ciphertext is always 128KB at the start of the file. I figure the reason for this is to discourage the average Joe from opening the files in an image or media player. Using data carving techniques I should be able to reconstruct any of these files after removing the first 128KB of ciphertext and injecting a good file header.

It should, considering JJP is likely still not using integrity checks on the files. The way to do this would be to take a 44100Hz signed 16-bit stereo WAV file, extract the section you want with a hex editor, and simply paste in the bytes after the 131072 decimal offset. A good source of audio would be ripping a CD to WAV files.

I was thinking about how JJP can resolve the encryption issue. If the amount of data in the file to be encrypted can be adjusted in software, they can simply send out an update. But if this is a hardware limitation of the Sentinel dongles it would require a new encryption solution be implemented for future games and existing games would not be upgradeable. Furthermore, if JJP could release a software fix it would be in the form of a full game ISO since every asset file would need to be re-encrypted.

Hmmm. Ya know, since this is nothing more than a computer with a security dongle why not install whatever flavor of linux with Gnome or KDE or whatever GUI of your choice on a hard drive and then hook the hard drive up to the JJP PC. Download the ISO, mount the image. Make your changes and then create your ISO. Save it off on your thumb drive, hook up the original SSD and then update with your ISO on the thumb drive. Just a thought.

I still think it's sad that JJ would do this to their customers.

I won't be able to reconstruct any PNG or FLV files without the correct file header since I don't know things like dimensions, frame rate, etc. I will upload a WAV file of the recovered intro audio though.

I dont think they protected their software with the intention of bricking their clients. They have to protect the assets they invested in and tempering with an encrypted system will block it.

It is not an open platform they dont want others to use or it to become a component for others to use.

Agreed. It’s completely understandable why they do this. I also doubt they will care if customers modify their machines, as long as it is for personal use and no financial gain.

We've been testing different headers for the pngs.

One interesting thing we found is the PNGs look intact except they have their header and footer information stripped out.
There is also code in the boot scripts that assembles the manual, and it does so by adding this information into some PNGs and then by turning the bundle into a PDF.

That's why I'd be interested to see what the files on the physical drive look like.

Here is a picture of the dongle..

20190525_143600 (resized).jpg

Thanks, looked it up:

https://sentinel.gemalto.com/software-monetization/sentinel-hl-pro/