khang06

These are some fairly unorganized notes from reverse engineering the SayoDevice O3C. I doubt this information would be useful for most people, but it's better to put it out there than to leave it publicly undocumented.

Useful Links

CH32FV2x_V3x Reference Manual

CH32V307 SDK and samples

MounRiver Studio (toolchain for the CH32)

SayoDeviceStreamingAssistant

khang06

#include <Windows.h>
#include <gdiplus.h>
#include <stdio.h>

#pragma comment(lib,"gdiplus.lib")
using namespace Gdiplus;

// https://docs.microsoft.com/en-us/windows/win32/gdiplus/-gdiplus-retrieving-the-class-identifier-for-an-encoder-use
int GetEncoderClsid(const WCHAR* format, CLSID* pClsid) {
    UINT  num = 0;          // number of image encoders

khang06

import binascii
import sys
import string
import os

# the checksum algorithm operates on signed integers
def arsh32(n, b):
    n = n & 0xFFFFFFFFF
    n = (n ^ 0x80000000) - 0x80000000
    return (n >> b) & 0xFFFFFFFF

khang06

#include <Windows.h>
#include <stdio.h>

#define GAME_DIR L"D:\\Games\\Genshin Impact\\Genshin Impact game"
#define DLL_PATH "C:\\Users\\Khang\\source\\repos\\mhynot2-rewritten\\x64\\Debug\\mhynot2-rewritten.dll"

int main() {
    printf("hi\n");

    SetCurrentDirectoryW(GAME_DIR);

khang06

from z3 import *
from typing import List

# Please use this responsibly and not in any remotely competitive environment
class LogicSolver:
    def __init__(self, comparables: List[int]):
        self.comparables = comparables
        self.vars = {}
        self.solver = Solver()
    

khang06

using System.IO;
using System.Security.Cryptography;
using System.Text;

namespace mt3decrypt
{
    class Program
    {
        static readonly string MIDIKey = "$jshHgdn123&Am@n0te3+x";

khang06

0 || [Min: {0} Max: {1}]
1 || Data/_ExcelBinOutput/ShopGoodsExcelConfigData
2 || SetCombatFixedMovePoint
3 || value
4 || Transparent/Diffuse
5 || Diffuse
6 || AttachToStateIDMixin
7 || _Color
8 || _MainColor
9 || ConfigGuideInfoDialogAction

khang06

-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEAnjCTLhNi8UHdEUlXMMI//LO/TsulwLwfidD3Jey3EWIfHVfm
s9qE1IBCLl1X0Mb8TNJxFM26sREKnn13+W2MI8L11T8S1jse2c50Zqp5fg7/qwgM
1N/tM6jTU9tmX5SKM0zbLzBhFkTjXvFy67NDurNZLm8i/XBFKbLTNLu5wUSI6AIG
0vhBzFDILhCSHucPKk+JrFNbik+qeNd9wzTTzIhs2xcBlUzkyBQf64wgmsouZ+1q
HBlHDJDoMnM/LVUSELlq/TPK3QPUspCadgTxqbdqhXycSfshi/1VSxDWkD6Y4FUf
HbRsmn1fLKa/lw0nDZQR0I2nwnrxMUSAEEaGRQIDAQABAoIBAAxSyWx5+yfDU0cA
+SdlwplboWgwijmhDi3s1wwfzEUw6S6ehez19Yoecclt4ST1E3uim0edHVGk+7hM
GvgV9ihlDESwFLYWxfj+0eebmTpeTcGTr3g396EiIlByk5+XkUqczqh28uFKvZHM
aoD9JqYZSbXJ16Z5xBGTCkwd4cMyBagHuZ9v3yCgigTIIM/vsggAVYTyZmxvmbFy

khang06

# simon wrote a decryptor first, so i based this off of his
import sys
from binascii import hexlify
from Crypto.PublicKey import RSA
from Crypto.Hash import SHA256
from Crypto.Cipher import PKCS1_OAEP
from Crypto.Cipher import AES

if len(sys.argv) != 3:
    print('usage: decryptdzhtml.py [input] [output]')

khang06

ThisIsLanguage Private API

totally unofficial, and is very subject to change

Cookies

Name	Description	Example (values may be censored)
til	no idea, the first part is the user id	10000069420_5c81bad1a3a8e2.87403434
ci_session	uri encoded (example is decoded for readability) also no idea what most of these values are	a:9:{s:10:"session_id";s:32:"d223e1f94e041a3ee3d9ef90aa5f17e1";s:10:"ip_address";s:12:"127.0.0.1";s:10:"user_agent";s:115:"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36";s:13:"last_activity";i:1552005746;s:9:"user_data";s:0:"";s:14:"school_user_id";s:0:"";s:12:"subscription";s:4:"full";s:8:"language";s:1:"2";s:22:"school_user_id_session";s:11:"10000069420";}693bb4598cac7347b5433e6009dd74943186b3b1

Authentication