ElectricLime
As seen on VMK
- Joined
- Jun 28, 2005
People are still curious, and I've been getting more questions about the VMK database! So here, this is the *really* secret stuff. I hope that posting about it will inspire people to be curious, so that when the Next Great Thing comes along, you'll get to the bottom of how it works...
First, some history.
Back in late 2005, when I began poking at VMK to see what made it tick, it really wasn't difficult to find the settings files. (See ElectricLime Speaks #1 - The Database Files.) And all of the settings files were in plaintext, meaning I could clearly see all of the game's items and messages, and thereby I could know exactly what pins and clothing had been added to the game but hadn't been released yet, and what new gameplay features had been added but not yet unveiled. I maintained a longrunning thread (two and a half years!) about what I found: "New items in the database".
But it seems that Disney didn't like having their secrets so easily laid bare. In April 2006, the settings files had several new items added with abbreviated names such as "I-S C P" or "B C B" or "C M Ha". From context, it wasn't hard to guess what most of these items were ("Inner-Space Crystal Pin", "Baseball Cap Blue", "Coral Magic Hat"), so this didn't hide their secrets very well. (See the "Additions 2-May" section in that "New items" thread for details.) I kept updating my list.
Then at the end of May, something very interesting happened. A large section had disappeared from the "external_texts" file; a section of room names was gone! For example, here are ten of the lines that suddenly went missing:
And, meanwhile, a new file named "encrypted_texts" had appeared, starting with text that looked like this:
Obviously, Disney was moving data out of their plaintext settings files into an encrypted file that looked like gibberish to the naked eye, a file that only the VMK program itself knew how to decrypt. The original plaintext database remained, but now most of the updates were secretly going into this encrypted file, away from prying eyes.
I noticed that a lot of the new encrypted data looked awfully like there was some kind of structure to it; it had spaces and linebreaks. And it also looked an awful, awful lot like the old data that had been deleted. Notice that the last ten encrypted lines I quoted here are the exact same lengths as the ten "missing" lines I gave as an example, and the spaces are in the exact same places? Here are four examples, side-by-side.
This was a challenge! It was obviously letter-substituting puzzle. But a letter didn't always translate to the same thing - note that in the first example, the word "Skull" corresponds to the code "0=g4Q". The '4' and the 'Q' both become an 'l'. What was going on here? How could this be solved?
After a lot of trial and error, I was able to figure out the puzzle and decrypt the file. In a nutshell, here's how it works. Take these two rows of letters, numbers, and punctuation:
For each letter in the encrypted file, find it in the first row, then take the letter immediately below it. Then take your position in the file (starting with 0), divide it by 64 and take the remainder, and back up that many letters in the alphabet.
For example, the first four letters in the encrypted data I quoted up above are "7rv6". Look up the 7, and under it is 'i'. Look up the r, and under it is 'u'; go 1 letter back in the alphabet to get 't'. Look up the v, and under it is 'g'; go 2 letters back in the alphabet to get 'e'. Look up the 6, and under it is 'p'; go 3 letters back in the alphabet to get 'm'. So "7rv6" decrypts to "item".
I wrote a program to do this for me automatically. So, every time a new encrypted_texts file appeared, I immediately could find out what was in it. Naturally I didn't post about what I found, because I didn't want Disney to know I cracked the code; if they found out, then they might change the way they were encrypting things. I didn't want to create more work for them!
In April 2007 they changed the key to this:
... which broke my decryption program, but it didn't slow me down much; within a day I had figured out the new code.
I do confess that there was *one* thing I was never able to figure out. At the bottom of the external_variables file are these lines. I couldn't ever make sense of them; I didn't need them to help me figure out the encryption, and they don't seem to mean anything. I hope that someday I can find someone to explain them.
On my web site you can find a copy of the very last encrypted_texts file, as well as what it decrypts to. If you have any skill at writing a computer program, try your hand at coming up with something that takes the encrypted file as input and spits out the decrypted file as output! Make sure you use the April 2007 key above, not the original key.
The last thing to tell you about are the resource files that VMK would load. The client code was written in Shockwave; as you played a session of VMK, it would quietly load hundreds of ".CCT" files in the background. These were "Adobe Director Encrypted Cast Files", and each one contained dozens or hundreds of script and image and sound files, similar to a zip. Adobe Director refuses to open these files. But I found a freeware CCT-to-CST converter program which turns these files into regular decrypted ".CST" Adobe Director Cast Files, which can then be opened and browsed by the free 30-day trial copy of Director that's downloadable from Adobe.com. I saved copies of many of these files, converted them, and was able to browse through thousands of VMK graphics and sounds - all of which I'm keeping very carefully saved away for posterity!
The moral of this story: Be curious. And be observant.
Other chapters in ElectricLime Speaks:
This concludes ElectricLime Speaks. Please come to the VMK Reunion at Walt Disney World on May 23!
First, some history.
Back in late 2005, when I began poking at VMK to see what made it tick, it really wasn't difficult to find the settings files. (See ElectricLime Speaks #1 - The Database Files.) And all of the settings files were in plaintext, meaning I could clearly see all of the game's items and messages, and thereby I could know exactly what pins and clothing had been added to the game but hadn't been released yet, and what new gameplay features had been added but not yet unveiled. I maintained a longrunning thread (two and a half years!) about what I found: "New items in the database".
But it seems that Disney didn't like having their secrets so easily laid bare. In April 2006, the settings files had several new items added with abbreviated names such as "I-S C P" or "B C B" or "C M Ha". From context, it wasn't hard to guess what most of these items were ("Inner-Space Crystal Pin", "Baseball Cap Blue", "Coral Magic Hat"), so this didn't hide their secrets very well. (See the "Additions 2-May" section in that "New items" thread for details.) I kept updating my list.
Then at the end of May, something very interesting happened. A large section had disappeared from the "external_texts" file; a section of room names was gone! For example, here are ten of the lines that suddenly went missing:
Code:
product.5001=Skull Rock
product.5002=Haunted Mansion Conservatory
product.5003=Tiki Tiki Tiki Room
product.5004=Tomorrowland Outerspace
product.5005=Jungle Cruise Explorer's Tent
product.5006=Pirate Prison
product.5007=Boot Hill Shooting Gallery
product.5008=Mad Hatter's Tea Party
product.5009=Maleficent's Evil Fortress
product.5010=Nautilus Submarine RoomAnd, meanwhile, a new file named "encrypted_texts" had appeared, starting with text that looked like this:
Code:
7rv6TBkC3glwwztWW
YBS9VR4iOhbLWNN
H4pKfhyPx0.sJjR
oyQjqrtY1H8mP8
h1y5Z39HTderztq9
eXuZN.ViKM3ZIn
kKXFsJfjMZU4.
Vgco8255lEh8f
MPdDrzzWYzCJt 4yl27 n *m26uY1 b6Ze*
wpzX=QQsoQDWK 19CFB x *HFNVRc UNi.*
oyQjqttSetY2x lx LumY om1
2YmrnHHLNHqG0tebTa (4/i)
XLTHUggAAg3n.pEKOF (P/2)
QAOg5GGeaGRUvsMy8j (0/X)
Pe8G9nnEInl5wq1Sbt (O/Q)
WEbn4UUMJU09c3BIKp (7/P)
=MKU7551e5ZI
MPdDrYSZbzRJw IzD
2YmrnECNNHoG3n 73CEbE
HIET=9.dxjfAf0=g4Q 3sKU
jAfQ8R71zrezeEMt5uhh QDtz6aa .YYTt9B1BXBL
BHpZcWKUfdgJgZNKc 9VO. n4oR pjfj
xhyims5eZzY0Yi6q1earWuPSq JXXuXkXuaY
BHpZcWKUfdgxgtU.N.N 1df4f. Y8JMAhi8'P =M8q
mq5xrye0BX3E3jtZ59t DXYnXX
nCBbLZcojsdydP=.U uKO4 3.sdAoMo 0OfJs7G
7mPf1Jtb30THTU8m Rl0T1T'X Pet 7rpEK
CFH0VT=sAMj7jSp.Nc.LVsA'A wvsj Ty8lPM52
mq5xrye0BXkk3glTTeYk3 Ppr9eCTBW 1EFEObviously, Disney was moving data out of their plaintext settings files into an encrypted file that looked like gibberish to the naked eye, a file that only the VMK program itself knew how to decrypt. The original plaintext database remained, but now most of the updates were secretly going into this encrypted file, away from prying eyes.
I noticed that a lot of the new encrypted data looked awfully like there was some kind of structure to it; it had spaces and linebreaks. And it also looked an awful, awful lot like the old data that had been deleted. Notice that the last ten encrypted lines I quoted here are the exact same lengths as the ten "missing" lines I gave as an example, and the spaces are in the exact same places? Here are four examples, side-by-side.
Code:
product.5001=Skull Rock
HIET=9.dxjfAf0=g4Q 3sKU
product.5002=Haunted Mansion Conservatory
jAfQ8R71zrezeEMt5uhh QDtz6aa .YYTt9B1BXBL
product.5003=Tiki Tiki Tiki Room
BHpZcWKUfdgJgZNKc 9VO. n4oR pjfj
product.5004=Tomorrowland Outerspace
xhyims5eZzY0Yi6q1earWuPSq JXXuXkXuaYThis was a challenge! It was obviously letter-substituting puzzle. But a letter didn't always translate to the same thing - note that in the first example, the word "Skull" corresponds to the code "0=g4Q". The '4' and the 'Q' both become an 'l'. What was going on here? How could this be solved?
After a lot of trial and error, I was able to figure out the puzzle and decrypt the file. In a nutshell, here's how it works. Take these two rows of letters, numbers, and punctuation:
Code:
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz=.
2rn6Ompih4b9BeDEqCFaJHXGNjPQx3SK15z0w.IVvZWfTY7kl8RAouUstg=cdyLMFor each letter in the encrypted file, find it in the first row, then take the letter immediately below it. Then take your position in the file (starting with 0), divide it by 64 and take the remainder, and back up that many letters in the alphabet.
For example, the first four letters in the encrypted data I quoted up above are "7rv6". Look up the 7, and under it is 'i'. Look up the r, and under it is 'u'; go 1 letter back in the alphabet to get 't'. Look up the v, and under it is 'g'; go 2 letters back in the alphabet to get 'e'. Look up the 6, and under it is 'p'; go 3 letters back in the alphabet to get 'm'. So "7rv6" decrypts to "item".
I wrote a program to do this for me automatically. So, every time a new encrypted_texts file appeared, I immediately could find out what was in it. Naturally I didn't post about what I found, because I didn't want Disney to know I cracked the code; if they found out, then they might change the way they were encrypting things. I didn't want to create more work for them!
In April 2007 they changed the key to this:
Code:
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz=.
10hmdyXVRpTO3rq9cGb5DHLtSEQiMNl7e64KZBI8oUfg2xFYv.CjAJ=PnukwWsza... which broke my decryption program, but it didn't slow me down much; within a day I had figured out the new code.
I do confess that there was *one* thing I was never able to figure out. At the bottom of the external_variables file are these lines. I couldn't ever make sense of them; I didn't need them to help me figure out the encryption, and they don't seem to mean anything. I hope that someday I can find someone to explain them.
Code:
#Encryption settings
clienttexts.encrypt=true
clienttexts.charactersencrypted=0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz=.
clienttexts.key=00R5Y.VVdFlboKlkMMc..MSTmNQ8Off7y6l..GG4W222RzwUmmejEDzNmmjj5ssnMcc9EAVGG3GG5dfcOn my web site you can find a copy of the very last encrypted_texts file, as well as what it decrypts to. If you have any skill at writing a computer program, try your hand at coming up with something that takes the encrypted file as input and spits out the decrypted file as output! Make sure you use the April 2007 key above, not the original key.
The last thing to tell you about are the resource files that VMK would load. The client code was written in Shockwave; as you played a session of VMK, it would quietly load hundreds of ".CCT" files in the background. These were "Adobe Director Encrypted Cast Files", and each one contained dozens or hundreds of script and image and sound files, similar to a zip. Adobe Director refuses to open these files. But I found a freeware CCT-to-CST converter program which turns these files into regular decrypted ".CST" Adobe Director Cast Files, which can then be opened and browsed by the free 30-day trial copy of Director that's downloadable from Adobe.com. I saved copies of many of these files, converted them, and was able to browse through thousands of VMK graphics and sounds - all of which I'm keeping very carefully saved away for posterity!
The moral of this story: Be curious. And be observant.
Other chapters in ElectricLime Speaks:
- ElectricLime Speaks: #1 - The Database Files
- ElectricLime Speaks: #2 - The Dictionary
- ElectricLime Speaks: #3 - The Complete Database
- ElectricLime Speaks: #4 - VMK Stories
This concludes ElectricLime Speaks. Please come to the VMK Reunion at Walt Disney World on May 23!
Do you have any deeper photos other then the lobby?
