SmashManiac

Secret room

Recommended Posts

Thanks to a tip from mgreed, I finally discovered definitive evidence of Brandon's fiancée's identity:

http://2013.globalgamejam.org/2013/super-surgeon-doki-doki-fun-time

It also explains the name "Shannon" in blue in the credits.

Unfortunately, it doesn't appear that her name nor her nickname is the deciphering key, at least not directly. I also already checked her personal website and its source code just in case Brandon would be devious enough to request her to hide a hint in there, but it doesn't appear to be the case thankfully. She might not even be aware of this metagame anyway (and let's not ask her, it would be rude and not fair play at all).

Of course, her identity may be completely unrelated to the deciphering key, but it's my strongest lead so far.

Share this post


Link to post
Share on other sites

Has any progress been made with secretroom.lua?

And also, you mentioned being able to decrypt PrincessChambersCopy, Smashmaniac, I fixed the encipher book command as you noted, but I can't seem to figure out or find the password that encrypts the book!

One more note, when you bring PrincessChambersCopy to Isis, she mentions that untrapping Christo will be "like a test", do you think one of the test passwords from her cave might relate to the decryption? Or have you already tried that?

Share this post


Link to post
Share on other sites

No progress since my last post, and I've been sick during the last month so I couldn't do any work on this problem. My next line of attack is to investigate the Steam Workshop assets, since nobody has used them in a mod yet.

As for PrincessChambersCopy, you need to patch the code before Christo gets trapped, otherwise the enciphering key will be random. If you use my hack from my first post before that event, the password will be an empty string. Alternatively, if you find a way to get the book while avoiding that event, the book will never get encrypted.

I don't think I tried using the passwords from the cavern. At least, not all of them. I doubt it'll work, but at this point it's worth a shot.

Share this post


Link to post
Share on other sites

Hmmm . . . I guess I patched the code incorrectly, a blank code didn't work.

I tried the passwords myself, but no success.

"Impossible", "Freedom", "Hack the planet", "seek knowledge", "change the rules", plus the port & number keys puzzles, plus the platform creation & moving puzzle.

Give you any ideas, though?

Share this post


Link to post
Share on other sites

I got excited when the research console description in Spacebase said something about wizards and 'DFSPISPOPD', but after that didn't work and I googled, turns out it's a reference to a doom cheat code and probably unconnected. (I think descriptions are new since 'release', which netted a free copy of hack'n'slash, so it seemed like it might be connected)

So no, I haven't, though I periodically get excited about an idea and try various forms of it out.

Share this post


Link to post
Share on other sites

After the research of SmashManiac, Netrix, etc. I'm pretty sure we are supposed to find the password and not break the encryption in some way.

I don't realy know much about encryption so i'm the wrong one for this stuff anyways.

But i tryed my luck, maybe i would get a lucky punch on this one.

So the usal reversing stuff: nothing in ntfs's alternate data stream.

while looking at the binarys strings i found this one: DFm3t4lFTW

turns out it's a string used in brutal legend and costume quest (both by double fine) to encrypt(?) the *.FSB files, which seem to be soundfiles used by FMOD.

other then that the strings don't seem to be the right way, but i'll keep going throw it.

hns.jpg

hns.jpg.53a27a852a5905aefcc547f2312a18ea

Share this post


Link to post
Share on other sites
while looking at the binarys strings i found this one: DFm3t4lFTW

turns out it's a string used in brutal legend and costume quest (both by double fine) to encrypt(?) the *.FSB files, which seem to be soundfiles used by FMOD.

I believe it's the key Double Fine uses to call the FSBank_Build function in all its products. And considering it's the same key for encryption and decryption, it may be possible to add custom audio in mods using it, since FMOD is free for non-commercial use. Pretty cool!

It's probably unrelated to the secret room, but it's a pretty cool find regardless. :)

Share this post


Link to post
Share on other sites

just to keep you guys updated:

I'm kind of tearing the game files apart right now.

There is also nothing in the resources of the binary hidden that looks like a password.

Just went throw the Icon-resource and i guess i'm pretty much done with the binary by now.

Guess the next logical step would be decompiling the fsbanks with the found password. does anyone know how to do that?

Share this post


Link to post
Share on other sites

Technically the game gives an interface that you can already use to access the audio. If you want full control however, you'll have to use FMOD Studio. I'm not sure if you also need to use the API or not since I've not super familiar with this product. In both cases, you can find the download links and the documentation at http://www.fmod.org/

Share this post


Link to post
Share on other sites

So i managed to extract the mp3's out of the FSB files.

Going throw them will take some time.

Are we allowed to post these game-files here? I could pack them into an rar-archive if anyone wants to take a look at them.

//Edit:

Hmm okay so ReverbTemplates.fsb contains a file called Reverb_Trigger_Stub.mp3 which is a voice saying "Looks like the mail hasn't arrived yet".

I don't think that's what we are looking for, i just want to have it saved on the forums here, just in case...

Share this post


Link to post
Share on other sites

That's a weird placeholder. lol

Considering the soundtrack is available for sale, posting everything is probably not a good idea. You may want to just give the instructions on how to extract the data if it's not intuitive.

Share this post


Link to post
Share on other sites

I went through pretty much everysoundfile now and sadly couldn't find anything.

I would have bet my ass that there would be an sstv in there somewhere.

Just like RedLeader allready thought, but Bob's Song is just plain 56k noises, SSTV sounds different.

To get the soundfiles use Luigi Auriemmas fsbext and the given password DFm3t4lFTW

http://aluigi.altervista.org/papers.htm#fsbext

FMOD Studio can't open them.

Note that some files won't play in VLC or WMP, use Audacity for example to play them back.

By the way, would be awesome if we could get Luigi to take a look at this. This guy is like the game-reversing-god.

Share this post


Link to post
Share on other sites

Soooo

\common\HacknSlash\Win\Audio\SFX\SFX_Characters.fsb contains Bob_Hell.mp3

which just dosn't fitt there. Listen to it and you will know what i mean.

I couldn't find anything in it, except that it says 7.MB around the beginning of the file.

Do you guys think that has to mean something or is it just a coincidence?

Screenshot 2015-01-11 19.32.19.png

578d008cb30cc_Screenshot2015-01-1119.32.

Share this post


Link to post
Share on other sites

From what I hear, it's just Bob's song played on an electric guitar. Nice find, but I'm not noticing anything strange with it. It's probably just a unused piece of audio left in the code. I encourage you to keep looking though!

Also, it appears that you do not have much experience using hex editors based on your last comment, so let me give you some tips. First, it doesn't really say "7.MB" - it's just that HxD encodes bytes in the left column as characters in the right column using your PC's default encoding (normally Windows-1252 as it appears to be the case here), and represents non-printable characters as dots (period is 0x2E, not 0x1C). Second, trying to extract meaning out of a random set of 4 consecutive bytes in a binary file is unlikely to yield any result, as you can easily find seemingly-interesting sequences in randomly-generated sequences of bytes too. You should try it yourself for fun.

Thanks for the extracting instructions by the way!

Share this post


Link to post
Share on other sites

Hmm yeah i thought so, i just put it up here so we don't miss anything.

Maybe someone would reconize it and be like "oh yeah thats the old trick, there is an rar archive appended to the file".

I just leech on to anything at this point because so far i have found absolutely nothing and i don't want to miss any little detail.

Share this post


Link to post
Share on other sites

As far as I know, we haven't.

Whatever it is, it's well and truly hidden.

I haven't had any new ideas.

Share this post


Link to post
Share on other sites
I haven’t had any new ideas.

OK, got a fresh brain full of ideas to be applied to the hunt... sounds like brute forcing was a no-go.

Sorry... posting from work so I have a lot of questions and not much to constructively contribute.

I want to check the Debug and Machine rooms for clues... but I haven't stumbled on a way to hack myself into rooms (I'll figure it out soon enough I'm sure).

From the sources it looks like the Machine room has it's own book pedestal... does it function in the same way as that on the DRMRoof?

Also... there's that one Empty Treasure chest... anyone figured out a way to "fix" it?

I'm wondering what the "better" password on the PortRock in LabRuins is... I hacked collision boxes to get past a second time but now I'm thinking about it I realize that whatever the new password is could be a clue... anybody solve it? (from looking at the code i think it's still checking one character at a time but skipping the eyes-lighting up... which should be reversible.)

Share this post


Link to post
Share on other sites

Well, it's been a while, so refresh my memory:

What empty treasure chest?

Also, I'm pretty sure I've found the new password for the labruins before and it wasn't particularly helpful, nor the password itself. Lemme hack in real quick and recall what it is . . .

edit: oh wow, I remember *nothing* about this game anymore. I don't even in the slightest recall "SecretRoom2.lua", and that seems like something I would remember (edit2: It seems to be an empty file I created myself for reasons I don't recall)

Share this post


Link to post
Share on other sites

This is the Empty chest... the label is "TreasureChest (charge puzzle)" which made me wonder if maybe I needed a turtle to charge it to get the right item out of it maybe... but I don't seem to have a SpikeyTurtle to interact with it... it's possible I edited their object to kill itself or that they don't spawn once you've cleared the swamp corruption... actually... probably that last thing I'll try it next try.

edit: Yeah, no SpikeyTurtles was fixed buy putting the corruption back... still no idea on how to make the chest not be empty... letting a turtle ram it had no apparent affect before or after opening.

TreasureChest_charzzz.png

NothingA.png

NothingB.png

TreasureChest_charzzz.png.eede88498fa411

NothingA.png.25b67809a6930051c0f316470f4

NothingB.png.6d421904401a3e3353458446f8a

Share this post


Link to post
Share on other sites

Going into the room book for central forest, it doesn't contain any alternate speech for the chest, just those two lines. I don't see anything in the chest init that would load things different, nor in the mapfile.

I think it's called the charge test because when you're first there, you need a turtle to charge into the rock in front of the chest to break it.

I need to replay the game, though, I don't even remember how to navigate the library effectively.

Share this post


Link to post
Share on other sites
I want to check the Debug and Machine rooms for clues... but I haven't stumbled on a way to hack myself into rooms (I'll figure it out soon enough I'm sure).

Exit points are defined in the onInit() method of each room if I remember correctly.

From the sources it looks like the Machine room has it's own book pedestal... does it function in the same way as that on the DRMRoof?

Actually, I don't remember what MachineRoom is, or if it's even loadable.

Also... there's that one Empty Treasure chest... anyone figured out a way to "fix" it?

I don't think it's fixable. Opening the chest calls CentralForest.onChargePuzzleTreasureChestOpened() which does not contain branching instructions, and CentralForest only has 3 other methods that are already called in normal gameplay.

I'm wondering what the "better" password on the PortRock in LabRuins is... I hacked collision boxes to get past a second time but now I'm thinking about it I realize that whatever the new password is could be a clue... anybody solve it? (from looking at the code i think it's still checking one character at a time but skipping the eyes-lighting up... which should be reversible.)

This is defined in LabRuins.onInit(). The upgraded password is "wizardrulez".

I think it's called the charge test because when you're first there, you need a turtle to charge into the rock in front of the chest to break it.

I was about to say that. :)

P.S.: Skimmed through the DDS files today to check for unused content, and found some Link sprites from A Link to the Past in a placeholder folder. Whoops!

Share this post


Link to post
Share on other sites

Cool to see some new ideas here.

The DDS files? What was that? ALTTP is awesome, i have to take a look at the sprites :D

Share this post


Link to post
Share on other sites

Oh, I think I failed to mention this, sorry about that. The sprites data is stored in DirectDraw Surface (DDS) format and compressed in GZip (GZ) format. I've been using 7-Zip and NVIDIA's Windows Texture Viewer to view the data.

The files are all stored in the Win/Munged directory. The ALttP sprites are in Win/Munged/Characters/Placeholder/Hero/Hero1.dds.gz

Share this post


Link to post
Share on other sites

Brandon did say that this was the most concerted effort, but of course that doesn't mean we're making good progress...

Share this post


Link to post
Share on other sites

Well, it's nice he's still checking on us.

I made another few hundred guesses at the password. Nothing seems to be working. Tempted to go through those encryption steps I saw somewhere and just keep it running in the background, and trying out the reasonable passwords.

(It's also AES, and we have both an idea of the restricted domain and of the length of the passcode, so I'm pretty sure I know someone who could use that to make the cracking attempt more efficient).

I also know that if we found the password that way, I wouldn't feel very excited or happy about it.

Share this post


Link to post
Share on other sites

Nope. What's the point if I won't be happy about the result?

Feel free to do so, and then if you get a solution to drop me hints so I can find it the 'proper' way, though. :P

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now