The Story to Save a Couple of Lost Keitai Games.

Here I was back in 2024 browsing the Twitter like I normally do, and I saw this post from someone called RockmanCosmo (which I had followed previously) asking if anyone would be willing to join the team to help on recently recovered Before Crisis Final Fantasy VII. Me being me, I jumped in headfirst, and well, that game is doing okay, and we are making progress all the time. However, something else occurred during this same time: we were given the full version of Dirge of Cerberus: Lost Episode. Naoya Shinota had been in talk with a person who had the full version for many years before they were nice enough to dump their SD card. The only issue is that these SD cards are encrypted. “No problem,” we said; we had a solution for this. However, the issue we had was that we needed a special partition from the SD card to start the brute-force process to find the keys.

This was the first time we have encountered such an issue, because normally we are the ones who have possession of the SD card, so we could get the secret key needed. And well, unfortunately, even two years later we never got that. So this past week I said enough is enough; I’m going to solve this issue. We have the data; we just need to unencrypt it. Let's figure out how.

We had only two ways to accomplish this.

One was to find out how the encryption worked and then do it in reverse. Unfortunately, that’s not very easy; we have tried to find this for many years now and have had no luck doing so, because, unfortunately, the phone held the kinds to kingdom, and we are sure that the simcard and many other steps were taken to generate the master key to the SD Card.

Option two… Manually brute-force each file on ourself and figure it out. So this sounds easy in premise, right? Just brute force the key. Well, that’s not how this really works, unfortunately. In order for us to brute force something, we have to know what a known-good looks like. Which allows us to test a small handful of bytes against the known good so we can see if we decrypted it. Testing to many bytes, though, would slow the performance of this attack to be way too slow to be feasible.

The problem is these keitai games had no standard system for storing data; they could just be blobs of random data, and we have no idea what to do. Thankfully we can do one thing, which is inspect the game and see what it does with this SD card data, which loads after it’s decrypted. Thankfully I got lucky that DoC was only partially obfuscated, which made this process significantly easier. We could see it had a file called "MountSdFileSystem." After some investigating, Dirge of Cerberus was pretty clear about what it did, which was it took every file it downloaded and saved to the SD card, encrypted it, and then when it was time to load it, it was decrypted and then processed as a zip file.

“Eurica!” That’s the simple key to Dirge of Cerberus; we simply just need to test a couple of bytes against known good PKZIP headers. Simple enough. Well, that’s where the next issue comes from. You see, the TKURE (the encryption key) in this case was big, like 0xFFFFFFFFFFFFFF or 72,057,594,037,927,935 but remember we needed to do this for every file which is well that very big number multiplied by 16. If you look at that number and give it to an RTX 5090 and ask it to crack it, you would be looking at roughly 130 GKeys/sec for 7 days of non-stop cracking to solve just 1 file. Not even knowing if you had the right variables set for it to find it. So I did what any sane person would do and just went crazy at figuring this out. So I started out with my 3 machines that were doing roughly 100 G-Keys a sec and let that run until I finally cracked the first key. “Perfect,” I said, thinking about how it was done for the SD cards. I was like, “Now we can assume the keys might be next to this one.” But alas, no avail. No matter how long and hard you search nearby, the first key you would find would be nothing. So that meant one thing. I needed to brute force all TKURES 1 by 1.

The process and program I was using could only decrypt via one computer at a time. I set out to make my own distributed brute-force program that would allow me to send jobs to machines over the internet to start mining for the right key. I did just that; I made my own optimized brute-force software that used OpenCL as a base. For every machine I could join to my software, it would send out 100 blocks to have that machine attempt the decrypt, and if it found it, it would send it back to my server and then automatically move onto the next one. There became one issue here. I felt like I couldn’t just ask people to install my software and trust me that I was not mining bitcoin, while also telling them, “I am working on a secret project; trust me, bro.” Thankfully I am quite trusted in the community, so I was able to get a few people to help, like Naoya and Tofu, who were gracious enough to lend out 3 GPUs to help with the task. But even with all those and mine, we will still be looking at maybe 3 months to get this done. So I did want any engineer of my caliber to do it. I made a GPU farm, and no, I am not joking. I spun up well over 90 GPU Servers to crunch these numbers so fast, spanning from RTX 4090s, A4000s, A4500s, A5000s, RTX 6000s H200, and more. To the point I had over 125 active clients crunching away. All of these combined, I was putting out nearly 5,500 GKeys/s. That’s well over 70x as fast as my single 7900XTX could put out.

Seriously, for all 1 million blocks, it could crunch through those in less than 4 hours.
The next biggest problem was, well, these cost a lot of money to run. Well, you would be right, but thankfully I made some really good optimizations in my code to help “get lucky” and solve the key faster. You see, for every machine that would join, we would perform a round-robin on the blocks we would mine. The pattern would be the first 100 blocks from the very start, the next 100 from the end going backwards, the next 100 from the middle going to the end, and the next 100 from the middle going to the start. Because patterns started to develop that a lot of these keys were near the end, start, or the middle. So this had saved me a significant amount of time with decrypting. All said and done, this cluster and software I made had chomped through and found all the decryption keys in roughly 72 hours. I loved to see the next time I have to use this go even faster!

Now, I’m not going to lie and say it was still cheap; in total, this endeavor to save one game cost me well over $900 dollars, all said and done. But in my books it was well worth something we may have never had the opportunity of getting again.

I am going to wrap this up and say that Dirge of Cerberus: Lost Episodes—the full game—has now been officially preserved and is playable for everyone.

This is not where the story ends, though; some of you might know of another game that was preserved around this same time, and we struggled with the same issue. All I can say is stay tuned… It's being worked on, while it is a little bit more complicated than DoC, I've already figured it out, and it will be getting released when it's done. Expect another story from me when that happens. I have a lot more to say.

• Yuvi

https://x.com/YuviApp
https://bsky.app/profile/yuvi.app