"How does this game communicate!?"
Generally, communication is done over plain HTTP. Headers (as far as I can tell) are not used; I could be wrong on that fact, but I have no observed anything weird happening if I don't include certain headers.
Any encryption done uses AES128 ECB with a block and key size of 128, padding data with zeros, followed by being the encrypted result being represented in Base64.
Data is contained in JSON objects (typically, all data is wrapped inside of a named JSON object for some reason).
Client to Server
Oddly enough, client to server isn't fully encrypted at all. If there is any encryption present, it is only done to any strings being passed from client to server. Other than that, expect plaintext.
Server to Client
Data transmitted from the server is fully encrypted, however, unlike the client to server, there is no "nested" encryption. The client expects everything to be plaintext once the content is decrypted the first time.The infamous brick wall we can't break.
This file (on Android) is stored under /data/data/jp.co.nexon.kemo/files/kemofure/resources/common/common/data0.bytes.
It's loaded before either the client attempting to view the tutorial or view /mypage/get by class MasterData.cs.
The heart-breaking part is that it is encrypted with Rijndael-256 with a block and key size of 256, making it practically impossible to recover the key. The default keys (appDecryptionKey/UtilData.AES_KEY) provided (QeEjSWTbFK2876yB or b8PWNMsYCt47YAai) do not work with this file; it's encrypted with a different key. However, we at least know the IV (FLXR4JXfD6Cw5jsJtj7VnferY93k4Zsg).
"I have the key!"
Should you, or anyone else, happen to have or stumble across the decryption key (either you sniffed it or somehow logged the HTTP request), please contact me on Discord.
"I want to help find the key!"
Unfortunately, while the Servals working in Nexon's programming department may have some of the most convoluted code possible (we'll call it a unique style of code), it does not look like finding the key will be something you randomly stumble across. However, here are some ways to try finding them:
- The most likely way to find it (and how I've been doing it) is to simply download other Nexon mobile games into an emulator with ProxyDroid setup to redirect traffic to a Fiddler instance. Look for any "startup" HTTP requests and see if they have a key. If they do, tell me them on Discord.
- Downloading APKs of any Nexon mobile games and decompiling them, inspecting any classes that could contain keys. Essentially, you're looking for any class that has the word "Crypto" in it, but the key could be hiding in other classes.
- Seeking assistance from others that could potentially have the key. This is probably the 2nd least likely, as they're probably not going to share the key (this is something that's probably sought after by many other developers). The most promising people who might have such key (or at least a decrypted copy of the data) are anons running around on the Gamerch wiki with the ID
CB26BC965F and CFF60E1F35.
- Dressing up in a suit and walking on over to
Shinkawa 2-3-1 Chuo-ku, Tokyo 104-0033 Japan, politely asking for the decryption key. We've tried getting Bird and Shadow on this, but they've declined :(
"Let's recreate the file!"
... is our current best bet. The syntax of the file is relatively simple:
[number of elements]>[JSON elements]
The structure of the file has been documented:
MstLevel
| Field Name
|
Type
|
Comment
|
| level
|
i
|
internal ID
|
| exp
|
i
|
possible EXP rewarded at end of level?
|
| maxStamina
|
i
|
possible stamina required? not too sure.
|
MstItem
| Field Name
|
Type
|
Comment
|
| id
|
i
|
internal ID
|
| name
|
s
|
Name of the item
|
| info
|
s
|
Description of the item
|
| unit
|
i
|
??? unsure
|
| itemType
|
i
|
internal ID referencing the type
|
| itemTypeValue
|
i
|
unsure what it references
|
| possessionLimitCount
|
i
|
maximum amount that can be inside inventory
|
| effectRarity (optional)
|
i
|
internal ID referencing the rarity of the item (possibly just visual) (default: 1) (1-6?)
|
| sortNo (optional)
|
i
|
possible sorting index for when viewing (i.e item with sortNo 1 would be first, 2 would be second etc) (default: 1)
|
MstCharacter
| Field Name
|
Type
|
Comment
|
| id
|
i
|
internal ID
|
| name
|
s
|
Name of the character
|
| rarity
|
i
|
rarity value (knowing typical gatcha, from between minimum of 1 to maximum of 6)
|
| maxLevel
|
i
|
highest level possible with character
|
| hp
|
i
|
base hitpoints?
|
| maxHp
|
i
|
hitpoints when fully grinded out?
|
| attackType
|
i
|
internal ID referencing the type of attack done (enum index number possibly)
|
| attack
|
i
|
default amount of damage?
|
| maxAttack
|
i
|
maximum amount of damage?
|
| moveSpeed
|
i
|
movement speed of the character (unsure of what range though)
|
| attackSpeed
|
f
|
attack speed of character (? my guess is 1.0 would mean 1 attack a second)
|
| attackRange
|
i
|
the attack range/reach of the character
|
| reach
|
i
|
melee reach? unknown, really
|
| weight
|
i
|
how many japari buns does this character eat :^)
|
| knockBack
|
i
|
units to move attacked unit back?
|
| sameAttackCount
|
i
|
unknown, possible how many times the character can repeat a single attack
|
| attribute
|
i
|
attribute of character (cool, beauty, whatever else was TL'd from that attribute array)
|
| groupId
|
i
|
group id of the character (not sure
|
| skillId
|
i
|
unsure, maybe the internal power skill ID the character has?
|
| skillChargeSpeed
|
f
|
unsure, since it's a float, i'd assume "1" is fully charged and "0" is no charge
|
| readerSkillId
|
i
|
unsure, don't know what a reader is
|
| skillSE
|
i
|
skill sound effect index?
|
| cost
|
i
|
cost to summon unit
|
| limitBreakStatus
|
a
|
no clue
| maxLevel
|
i
|
maximum limit breaks
|
| maxHp
|
i
|
unknown, what would hp would have to do with limit breaks?
|
| maxAttack
|
i
|
unknown
|
|
| goodField
|
i
|
field type that is beneficiel for the character
|
| badField
|
i
|
field type that is detrimental for the character
|
| nocturnal
|
i
|
unknown, possible time-related (owls do more damage at night or something? i wouldn't have a clue)
|
| critical
|
f
|
crit chance
|
| baseCharacterId
|
i
|
internal base character ID, possibly for when characters evolve or have multiple rarities
|
| profile
|
s
|
description?
|
| scientificName
|
s
|
name of the character in scientific terms (i.e Suri Alpaca is "Vicugna pacos")
|
| genus
|
s
|
the genus of the character (i.e Suri Alpaca is "Vicugna")
|
| redlistCode
|
i
|
conversation status?
|
| word
|
s
|
???
|
| voiceArtist
|
s
|
seiyuu
|
| size
|
i
|
size of the character (unknown units)
|
| specificVirtue
|
a
|
???
| mstEventId
|
i
|
???
|
| mstSpecificVirtue
|
i
|
???
|
|
| maxLimitBreakReducePercent (optional)
|
i
|
??? (default: 0)
|
| effectRarity (optional)
|
i
|
rarity of the character's special effect? unsure. (default: 1) (1-6?)
|
| eventLimitBreakFlag (optional)
|
i
|
unknown (default: 0)
|
| tieUpFlag (optional)
|
i
|
unknown; also... :2lewd: (default: 0)
|
MstCharacterRarity
| Field Name
|
Type
|
Comment
|
| rarity
|
i
|
rarity of a character? (1-6)
|
| salePrice
|
i
|
possibly how much they cost?
|
| dropPercent
|
i
|
chance to get character
|
| maxLimitBreakCount
|
i
|
maximum amount of times the character can be limit broken
|
| stockExp
|
i
|
amount of xp when obtained? (default: based on rarity, can be: 0, 500, 1000, 2000, 5000, 10000)
|
| maxLimitBreakReduceCoin
|
i
|
??? (default: based on rarity, can be 0, 0, 0, 30, 100, 300)
|
MstLevelCharacter
| Field Name
|
Type
|
Comment
|
| characterLevelList
|
a
|
possibly referencing data per level (how much to get to this level, etc)
| level
|
i
|
not much to say; it's the level
|
| exp
|
i
|
exp required?
|
| limitBreakStep
|
i
|
???
|
|
MstUpGrade
I actually don't know what this is used for.
| Field Name
|
Type
|
Comment
|
| level
|
i
|
???
|
| cost
|
f
|
???
|
| hp
|
f
|
???
|
| attack
|
f
|
???
|
| knockback
|
f
|
???
|
| weight
|
f
|
???
|
| hpRecover
|
f
|
???
|
MstKemonoLevelUp
| Field Name
|
Type
|
Comment
|
| getUp
|
f
|
??
|
| recoverSpeed
|
f
|
??? how fast to recover per second? or something?
|
| needKp
|
i
|
?? unknown
|
MstGroup
| Field Name
|
Type
|
Comment
|
| id
|
i
|
internal group id
|
| name
|
s
|
name of group
|
| information
|
s
|
possibly description or profile
|
| effectValues
|
s
|
a string of integers, seperated by commas (i.e "1, 2, 3, 4, 5")
|
| members
|
s
|
a string of members, seperated by commas (i.e "a, b, c")
|
| prefixString
|
s
|
prefix for the group for its members
|
| suffixString
|
s
|
suffix for the group for its members
|
| effectInformation
|
s
|
possibly information regarding how the effect values work; could be informational and not do anything
|
MstSkill
imagine combining 6 friend attacks all at once :wao: (ty Chojiki for explaining how it worked)
| Field Name
|
Type
|
Comment
|
| id
|
i
|
internal skill id
|
| name
|
s
|
name of the skill
|
| info
|
s
|
display information for skill?
|
| prefixString
|
s
|
prefix for skill name
|
| middleString
|
s
|
the skill name itself
|
| suffixString
|
s
|
suffix for skill name
|
| skillEffectId
|
s
|
comma seperated string of integers (i.e "1, 2, 3, 4")
|
| skillChrageSpeed (optional)
|
f
|
speed at which the skill charges (default 4f)
|
| skillSE (optional)
|
i
|
skill sound effect index? (default 0)
|
| skillWaitingTime (optional)
|
i
|
how long to wait before recharge (milliseconds?) (default 3000)
|
| resourceId (optional)
|
i
|
internal id for visual effects? (default 0)
|
| skillStartUpCondType (optional)
|
i
|
conditions for getting the skill pulled off? (default 0)
|
MstAccessory
| Field Name
|
Type
|
Comment
|
| id
|
i
|
internal id for accessory
|
| name
|
s
|
name of the accessory
|
| information
|
s
|
flavor text
|
| useCondType
|
i
|
ID for condition type in which this accessory can be equipped? (maybe restricted to type?)
|
| useCond
|
i
|
ID for condition?
|
| effectType
|
i
|
??
|
| effectValue
|
i
|
??
|
| salePrice
|
i
|
the value of the accessory in, maybe, gold?
|
| effectRarity (optional)
|
i
|
special effect for rarity (default 1)
|
BusLevelList
No clue what this does
| Field Name
|
Type
|
Comment
|
| type
|
i
|
???
|
| level
|
i
|
???
|
| gold
|
i
|
???
|
| defaultKp
|
i
|
???
|
| hp
|
f
|
???
|
| attack
|
f
|
???
|
| addKp
|
f
|
???
|
MstBusParts
could possible be related to MstItem?
| Field Name
|
Type
|
Comment
|
| id
|
i
|
internal id referring to the bus part
|
| name
|
s
|
name of the part
|
| info
|
s
|
flavor text?
|
| type
|
i
|
type of part?
|
| useCondType
|
i
|
??
|
| useCond
|
i
|
??
|
| effectType
|
i
|
??
|
| effectValue
|
i
|
??
|
MstLogin
| Field Name
|
Type
|
Comment
|
| count
|
i
|
how many times to login to recieve reward
|
| rewardList
|
a
|
rewards at x amount of logins
| type
|
i
|
type of award
|
| typeValue
|
i
|
??? value of type?
|
| amount
|
i
|
the amount recieved
|
|
MstCostume
suri alpaca in shoebill costume??? ehehe...
| Field Name
|
Type
|
Comment
|
| id
|
i
|
id for costume
|
| name
|
s
|
name of the costume
|
| info
|
s
|
flavor text
|
| effectType
|
i
|
???
|
| salePrice
|
i
|
gold value of costume??
|
| colorVariation
|
s
|
flavor text variation?
|
| effectRarity (optional)
|
i
|
rarity special effect for item (default 1)
|
| displayGroup (optional)
|
i
|
??? (default 1)
|
| useCondSize (optional)
|
i
|
i guess certain friends can't wear certain costumes based on size (default 0)
|
MstCharacterStoryQuest
| Field Name
|
Type
|
Comment
|
| id
|
i
|
id for the story quest
|
| name
|
s
|
string name for quest
|
| stamina
|
i
|
stamina required?
|
| fieldId
|
i
|
the field type for this quest
|
| night
|
i
|
ah, this makes the "nocternal" field make sense; probably 0 for false, 1 for true; makes the field night-time
|
| waveCount
|
i
|
amount of waves
|
| linkMapId
|
i
|
next quest point on the map?
|
| linkAreaId
|
i
|
next quest point in the area?
|
| linkSymbolId
|
i
|
???
|
| nextIds
|
s
|
no idea how this is formatted
|
| rewardItemId
|
i
|
the ID of the item rewarded at the end of the quest
|
| startAdvCharaId (optional)
|
s
|
???
|
| endAdvCharaId (optional)
|
s
|
???
|
| chapterSubtitle (optional)
|
s
|
???
|
| episodeSubtitle (optional)
|
s
|
???
|
MstLevelMission
| Field Name
|
Type
|
Comment
|
| id
|
i
|
id for the mission
|
| name
|
s
|
string name for mission
|
| information
|
s
|
flavor text
|
| nextMissionId
|
i
|
the next sequential mission ID
|
MstBus
| Field Name
|
Type
|
Comment
|
| id
|
i
|
id of bus
|
| name
|
s
|
name of bus
|
| information
|
s
|
flavor text
|
| useCondType
|
i
|
condition type
|
| useCond
|
i
|
condition
|
| effectType
|
i
|
effect type ID
|
| effectValue
|
i
|
value of the effect ID
|
| itemId
|
i
|
???
|
| groupId
|
i
|
???
|
MstSpecificVirtue
| Field Name
|
Type
|
Comment
|
| id
|
i
|
internal id for virtue
|
| type
|
i
|
type of virtue
|
| value
|
i
|
value of virtue
|
| targetId
|
i
|
???
|
| resourceId
|
i
|
target resource ID
|
MstArea
I can't figure out how this works exactly. The code is confusing.
| Field Name
|
Type
|
Comment
|
| id
|
i
|
ID for the area
|
| name
|
s
|
Name of the area
|
MstQuestArea
might be bugged? this doesn't take input json data
MstQuestSymbol
| Field Name
|
Type
|
Comment
|
| id
|
i
|
id for the symbol
|
| type
|
i
|
type of symbol
|
| iconId
|
i
|
the internal resource ID for the icon
|
| x
|
i
|
possibly X offset?
|
| y
|
i
|
possibly Y offset?
|
MstEvent
All fields are optional in this.
| Field Name
|
Type
|
Comment
|
| id
|
i
|
id for the event
|
| type
|
i
|
type of event
|
| name
|
i
|
name for the event
|
| countMstItemId
|
i
|
how many item IDs are involved
|
| informationUrl
|
i
|
??? maybe URL for additional information about the event
|
MstCampaignQuestNotice
switch (this.NoticeType)
case 1:
this._APService = true;
this._RaidUp = false;
this._Guerrilla = false;
break;
case 2:
this._APService = false;
this._RaidUp = true;
this._Guerrilla = false;
break;
case 3:
this._APService = true;
this._RaidUp = true;
this._Guerrilla = false;
break;
case 4:
this._APService = false;
this._RaidUp = false;
this._Guerrilla = true;
break;
case 5:
this._APService = true;
this._RaidUp = false;
this._Guerrilla = true;
break;
case 6:
this._APService = false;
this._RaidUp = true;
this._Guerrilla = true;
break;
case 7:
this._APService = true;
this._RaidUp = true;
this._Guerrilla = true;
break;
All fields are optional in this.
| Field Name
|
Type
|
Comment
|
| id
|
i
|
id for the notice (default 0)
|
| noticeType
|
i
|
type of notice (default 0)
|
| displayImageName
|
s
|
path to image for notice? (default empty string)
|
| startDatetime
|
l
|
when the quest starts? (unix epoch time probably) (default 0, or January 1st, 1970, 00:00:00)
|
| endDatetime
|
l
|
when the quest ends? (unix epoch time) (default 0, or January 1st, 1970, 00:00:00)
|
MstSerif
font?
| Field Name
|
Type
|
Comment
|
| id
|
i
|
id for the serif
|
| type
|
i
|
type of font?
|
| mstCharacterId
|
i
|
???
|
| displaySeq
|
i
|
??
|
| editType
|
i
|
??
|
| serif
|
s
|
??
|