Fortnite Encryption Key Thread

[Gildor]

I'd like to provide a few hints which might be useful for those who have programming and assembly-level debugging skills.

• Only pak file index is encrypted. It is read during game startup, so putting any breakpoint after that is useless.
• Having a good C++ code reference is good. Pak file index loading code is in FPakFile::LoadIndex() - Engine/Source\Runtime\PakFile\Private\IPlatformFilePak.cpp.
• Decryption is done with following code:

Code:

// Decrypt if necessary
if (Info.bEncryptedIndex)
{
DecryptData(IndexData.GetData(), Info.IndexSize);
}

• It calls this:

Code:

void DecryptData(uint8* InData, uint32 InDataSize)
{
SCOPE_SECONDS_ACCUMULATOR(STAT_PakCache_DecryptTime);
FAES::FAESKey Key;
FPakPlatformFile::GetPakEncryptionKey(Key);
FAES::DecryptData(InData, InDataSize, Key);
}

• So, you may see that the key is requested by calling FPakPlatformFile::GetPakEncryptionKey() and passed to FAES object's constructor.
• Key is requested with following function:

Code:

void FPakPlatformFile::GetPakEncryptionKey(FAES::FAESKey& OutKey)
{
FCoreDelegates::FPakEncryptionKeyDelegate& Delegate = FCoreDelegates::GetPakEncryptionKeyDelegate();
if (Delegate.IsBound())
{
Delegate.Execute(OutKey.Key);
}
else
{
FMemory::Memset(OutKey.Key, 0, sizeof(OutKey.Key));
}
}

It calls delegate, so locating this place is not very easy.

• So, the best location for breakpoint is FAES::FAesKey class (Engine/Source/Runtime/Core/Public/Misc/AES.h ). Of course, you can't see where this function is located - you don't have any information in assembly mode. However FAES::DecryptData() does the following:

Code:

void FAES::DecryptData(uint8* Contents, uint32 NumBytes, const FAESKey& Key)
{
checkf(Key.IsValid(), TEXT("No valid decryption key specified"));
DecryptData(Contents, NumBytes, Key.Key, sizeof(Key.Key));
}

It receives key as 3rd parameter. It performs some check, and throws an error "No valid decryption key specified". It is possible to find this message, and find places which has a reference to it. If this message is missing (for example, if engine was compiled with switched off error messages), then you should look for FAES::DecryptData() function. It has the following line in its body:

Code:

nrounds = rijndaelSetupDecrypt(rk, KeyBytes, AES_KEYBITS);

This function prepares decryption tables according to key contents, and it uses large data tables. These tables are all in that cpp file, and they are good patterns to find. Even more, I think it is possible to place a hardware breakpoint which will be executed when data read - you just should analyze rijndaelSetupEncrypt() C++ code and find which tables are used for decryption.

Hope this helps.

[Gildor]

"Taking out stuff" is not the main purpose of this program. It is most useful for people who wants to LEARN stuff.

Also, Epic knows about my program very well. Not all of them, but at least several people from the top of programming department. Nobody from Epic or other game company been told me that I'm bad and doing illegal stuff. I've got "thank you" from a few gaming companies over 10 years. There were just a few strange people on youtube etc - not game developers at all, who blamed me that I AM STEALING STUFF (cool - I'm almost not using UModel, and even if using - only for viewing content, and for testing of new umodel's functionality).

Fortnite game has protection, but it is not against extraction. You can't use extracted assets for anything public anyway. But it is because this is an ONLINE game, where people cheats. Cheaters are the primary and may be only the reason of protected game executable and data files.

[stairwave]

I think we should close this thread now, this is not going anywhere.

All you need to know is:
 AES key: 0x81c42e03b21760a5c457c8db7d52ba066f0633d0891fd9e37cf118f27687924a

Change the value from 06 to 05 like in my screenshot (it's always 27 bytes from the end) in every pak.
 

And please, for the future: think, check if it wasn't answered a few replies before, google, try out... and then ask, don't immediately type down a question the moment it comes up because most of the time you can answer them by thinking about it. Otherwise this cool Post gets filled with repeated questions and things found on google.

[XchickenXslayerX]

In which program and on which files do you have to run the codes to get the aes key?

[XchickenXslayerX]

There's no "getting codes" process. This is reverse engineering. Are you a programmer? Do you know assembly language? Did you ever disassembled any program?

No not really, but I want to learn disassembling and reverse engineering. Do you know how to start with it?

[HunteriX]

I'm new here.

What about this :


38 encrypted?

[HunteriX]

They are files that ain't important.

Tnx for reply.
It's strange because now I see the difference. Example on the latest patch missing the folder PWB ( Packages / PWB ).
I think the latest patch has clouded this folder.