Skip to content

feat(cps): add CPS decryption, large GRF support, and error improvements#5

Open
guicaulada wants to merge 4 commits into
herenow:masterfrom
guicaulada:gc/feat/cps-decryption
Open

feat(cps): add CPS decryption, large GRF support, and error improvements#5
guicaulada wants to merge 4 commits into
herenow:masterfrom
guicaulada:gc/feat/cps-decryption

Conversation

@guicaulada

@guicaulada guicaulada commented Mar 19, 2026

Copy link
Copy Markdown
Contributor

Add support for extracting CPS/Fury-encrypted GRF files, fix extraction of large GRFs, and clean up error output.

  • Add -k/--key option to specify a CPS decryption key source
  • Support both CPS DLLs and raw S-box hex files
  • RC4 stream cipher decryption with fallback to plain inflate for unencrypted entries
  • Fix signed integer overflow on entry offsets > 2GB in large GRF files
  • Fix bug where compressed data was written to disk instead of decompressed data
  • Simplify error messages to single-line output without stack traces

Usage

Standard CPS DLL:

grf-extractor -g data.grf -k cps.dll -o output_dir

Raw S-box file:

grf-extractor -g data.grf -k sbox_dump.txt -o output_dir

Add -k/--key option to specify a cps.dll file for decrypting GRF
files encrypted with CPS/Fury encryption. The decryption module
extracts the RC4 S-box from the DLL's embedded key data and applies
RC4 stream cipher decryption before zlib decompression.

Falls back to plain inflate for unencrypted entries within encrypted
GRFs. Also fixes a bug where compressed data was written to disk
instead of decompressed data.
Bitwise OR with left shift produces signed 32-bit integers in JS,
causing offsets >= 0x80000000 to become negative. Use unsigned right
shift (>>> 0) to convert entry fields to unsigned 32-bit values.
Replace verbose multi-line error output with stack traces with
single-line messages showing the file path and error reason.
The -k flag now accepts both CPS DLLs (with NUMBER marker) and
plain text files containing a 512-character hex S-box. This enables
decryption of GRFs encrypted by obfuscated CPS variants where the
S-box must be dumped from runtime memory.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant