Help/Support Decrypt serialized media assets from app container files?

yeahbenlol · October 26

Whether on a device (jailbreak) or using PlayCover, Is it possible to view the assets which are being downloaded from server and cached locally while a game is running? This would be equivalent in web-development how the web-inspector network-tab works.

In ../Library/Containers/game/Data/ there are several folders, such as ../Documents/assetcache, which I believe is where all the media files are being saved for client. These files are all encrypted with a unique hex/serialization/binary.

Attempting to use the command

#zsh
file ../assetcache/0a0aab4e29db88eaa899f99a30fa6425/adc5884518a91a3f1be476f8f992f25d/adc5884518a91a3f1be476f8f992f25d

Returns "data".

I've attempted several Unity tools — such as UAB, AR, AS — all of which were unable to identify the file.

What are the techniques to decrypt these files? Or are there better ways in which to rip images from an ios game?

Updated October 26 by yeahbenlol
Additional context. Image link fix.

yeahbenlol · October 29

I've got a solution after several hours of trial-and-error.

Most apps and games are lean ipa/apk - they are downloading assets from the server during boot or shortly after a tutorial rather than bundling.

I was able to use a networking tool which captured all the incoming network requests.

I used the command-line-interface Wireshark, combined with Charles Proxy. This allowed me to record all the requests. The requests themselves were downloading to the assetcache folder which would encrypt them, although by directly going to the request URL myself I could point the download to a non-encrypted folder, ie Desktop.

Another tool I came across was Fiddler Everywhere. This would be my recommendation if you prefer graphic-user-interfaces.

With the files directly downloaded, they had the correct file-type, which in this game was .bundle as they were Unity engine assets.

I was able to explore these assets by expanding them with UABEANext.

Hopefully another ripper finds this useful.