Collectible Card Game Headquarters

Hey Guys,

hoping someone here can help, was wondering if anyone knew how to crack open the player profile file (steam/userdata/<id>/255420/remote/<id>.profile)

and if this is even where the game stores your custom decks that you have built?

ideally i want to be able to create a deck outside of the game like in the deckbuilder, but only using the game provided cards so no worrys about modding the ZED files.

datacut wrote:hoping someone here can help, was wondering if anyone knew how to crack open the player profile file (steam/userdata/<id>/255420/remote/<id>.profile)

The profile is encrypted and we don't know using what scheme it is encrypted with.

datacut wrote:and if this is even where the game stores your custom decks that you have built?

Yes, that is where the game stores your deck configurations.

datacut wrote:ideally i want to be able to create a deck outside of the game like in the deckbuilder, but only using the game provided cards so no worrys about modding the ZED files.

You still have to be able to read the ZED files to figure out what cards are present and what value each card is assigned for building purposes (unless you are going to test and hard-code all of them) so we still need information about the ZED files.

Thanks for the prompt reply riiak. i guess noone has attempted to reverse engineer the game enough to see how it encrypts the file. will let you know if i find out any more.

I thought to start a new thread, but this has a perfect topic!
I would like to share infos about profile file encoding. Sorry if I should be not clear and if my english isn't good enough...

First byte of file is randomized everytime game saves it. First thing you should do is a Xor operation beetween any byte and the previous one. Then, there is an area, starting at offset 1014 and ending at about offset 3165 (I'm not sure...), with exclusion of a little area inside, that need another Xor loop (that is, bytes in this area have to be done a Xor with bytes standing two bytes before). Last but one byte is again a random one and you have to know that second and last bytes are control ones and are related to user id.

I did an Excel file to decode and encode again saved profiles. You have to insert path and name of .profile file, then, clicking on "Decode" button, you'll obtain a .bin file that is simpler to modify with an hex editor than original one. By clicking "Encode" button (surprisingly!), program encodes it again, saves new file over old .profile one, and update hash.file, so that you can use it in Magic 2015.
Reading my code, however, is likely more clarifying than my explanation...

I strongly advice to backup folder with your profile files, before using my tool, cause I didn't introduce any check in code!

I still didn't understand meaning of every single byte but I'll write infos about a lot of them, hoping that someone could help in increasing file knowledge...

Let's see a further analisys of content of a decoded profile file.
As I said, first two and last two bytes contain no usefull infos. It's important to know just that, for a specific user Id, in original (un-decoded) .profile file, B0 Xor B1 (where B# is Byte at offset #) is costant, and the same for B0 Xor B14348 Xor B14349.

B3 - B1113 : In my experience, there are only zeros.

B1114 - B2113 : At the beginning, there is a sequence of 4-bytes integer; before finishing tutorial they are only 3, then 54. First number seems to me an offset for a specific point in a sequence of bytes that follow, then we have only a "0" in first case or 51 integer numbers that are "stats" in second one (some exemples: at 1138, number of practice games played; at 1198, number of black cards played; at 1266, total damage; at 1294, creature spell casted; at 1298, non-creature spell casted; at 1302, mana generated). Following there is number "1136" that I think is lenght of a starting sequence. Here we have 32 bytes that are generated when profile was created and that seem related to Id number, but 4 bytes after 12 are likely date of creation.
After a "FF FF" there are 30 bytes that I ignore meaning of, and then a strange sequence that is "40 06 40 06 40 06 40 06" when you just created profile and then can change a bit mainly in first 1 or 2 bytes.
After other 7 bytes, there is a very important area: 149 bytes that contain number of unlocked card! Every byte has 4 bit for istances of one card and 4 for another. It's possible to unlock all the cards, even premium ones, changing these numbers, and there is no check about limit of 4 cards, but I think we can consider cheating to obtain more than expected 976 cards. Following 364 bytes are zeros, but I think they are for cards that will be added in future, cause if you increase them, you increase number of cards that game declares present in your card collection!
Finally, after a misterious byte (maybe related to an error in my decode procedure), we have a variable number of "FF" till offset 2114.

B2114 - B2141 : Strange area that seems inserted after encoding of surrounding bytes. It has 24 zeros and then "E8 03 00 00", as far as I know.

B2142 - B4355 : I don't know...

B4356 - B4677: Mainly settings. First 3 bytes have to be considered at single bit level. At offset 4372, we have 12 bytes related to volume settings. Byte at 4384 is for "Quick duel" setting and can be 0, 1 or 2. In this area we have some other informations, like name of most powered creature controlled.

B4678 - B12805: Decks saved! There is space for 32 decks: any "slot" used has first 30 bytes for name and other 224 bytes. Empty slot have "FF 00" as last bytes.

B12806 - B12813 : Two "00" bytes and then one for "persona" selected. One byte "FF", and two that I don't know before one byte for difficulty (0, 1, 2), and one for cards order (0, 1, 2).

B12814 - B14345 : Notifications. First byte is "00" and second is number of notifications. Then any notification is 6 bytes long and I suppose has two bytes that are which type of notification, one with 4 bits for month and 1 bit indicating if notification is "unread", then one byte for day, one for hour and one for minute.

At the end we have two "00" bytes and then last two I yet mentioned.

I hope you could understand what I try to explain even if I wrote it badly...

I hate the in-game deck editor so I've used the given information to attempt to create my own profile editor so I can have a decent deck editor.

I've found that the last byte appears to be some sort of hash or checksum that includes the deck information.

The 2nd to last byte appears to be purely random and it's only purpose appears to be to encode the last byte.

I'm not sure what the hash/checksum algorithm is but the value is consistent with the same deck setup. I've scanned for simple xor/sum/subtraction and can't find an easy match.

The side-effect of not having the right byte is that DoTP rejects the profile and you start with nothing.

Any ideas?

psionmage wrote:I hate...
...
Any ideas?

Hi! As I wrote, last byte is related to user id and if you do a xor of first, last but one and last byte you'll obtain always same result for a single user.
However, you can use my code to decode and encode again .profile files, so you haven't to care about it (working on "decoded" file is simple!)!

Tried to do the same with the ipad version. The file is longer but there are similar sequences. I loaded the game but the profile reset after I tried to change the number of cards.