MH4U Save Decoding QuickBMS

# Monster Hunter 4 Ultimate
# Script to decrypt save file data
#
# Based on information from mhef by Seth VanHeulen
# https://github.com/svanheulen/mhef
#
# Written by HenryEx
#
# script for QuickBMS http://quickbms.aluigi.org

################################################
# Preparations

print "Setup..."

# set up virtual memory file for save data
  math TMP = 0x13E00
  log MEMORY_FILE 0 0
  putvarchr MEMORY_FILE TMP 0   # improves the speed with pre-allocation
  log MEMORY_FILE 0 0           # reset the position and size of the file


# Set up default values and keys
  get FILENAME filename 0
  get FILESIZE asize 0
  set FILESTART long 0
  set SAV_MH4U string "blowfish key iorajegqmrna4itjeangmb agmwgtobjteowhv9mope"
  set DLC_MH4U_EU string "AgK2DYheaCjyHGPB"
  set DLC_MH4U_JP string "AgK2DYheaCjyHGP8"
  set DLC_MH4U_KR string "AgK2DYheaOjyHGP8"
  set DLC_MH4U_TW string "Capcom123 "
  set KEY_MUL short 0xB0
  set KEY_MOD short 0xFF53
  set SUM long 0


# get savedata in memory for decryption
  log MEMORY_FILE FILESTART FILESIZE 0  # MEMORY_FILE is encrypted save data


################################################
# Decrypt save

print "Decrypting save"

print "-> Blowfish Decryption..."
# decrypt via blowfish
  Encryption blowfish SAV_MH4U
  log MEMORY_FILE FILESTART FILESIZE MEMORY_FILE
  Encryption "" ""

print "-> XORing with save key..."
# check if file looks properly decrypted & get save key
  get SIXTEEN short MEMORY_FILE
  get KEY short MEMORY_FILE
  math FILESTART + 4
  math FILESIZE - 4

  if SIXTEEN != 16
    print "[!] Save key doesn't seem to be decrypted! Blowfish decryption may have failed! Exiting..."
    CleanExit
  endif

# advance key and XOR 16b block of the file with it
  xmath XORNUM "FILESIZE / 2"
  for i = 0 < XORNUM
    xmath POS "(i * 2) + FILESTART"  # get current file position
    if KEY == 0
      math KEY = 1
    endif
    math KEY * KEY_MUL
    math KEY % KEY_MOD

    getvarchr DATA MEMORY_FILE POS short
    math DATA u^ KEY
    putvarchr MEMORY_FILE POS DATA short
  next i

print "-> Comparing save checksum..."
  get CSUM long MEMORY_FILE
  math FILESTART + 4
  math FILESIZE - 4

  for i = 0 < FILESIZE
    get SBYTE byte MEMORY_FILE
    math SUM + SBYTE
  next i
  math SUM u& 0xFFFFFFFF

  if CSUM != SUM
    print "[!] Checksum mismatch! Save chksum: %CSUM% - Calculated chksum: %SUM%! Exiting..."
    CleanExit
  endif


################################################
# Save files to disk

print "Exporting decrypted save to %FILENAME%"
log FILENAME FILESTART FILESIZE MEMORY_FILE

CleanExit