Metin2 Forum

Metin2 CryptedObject format: XTEA keys, compression, and the Item Proto

If you have ever tried to read or modify Metin2's data files directly, you have probably run into the CryptedObject format. It is the container the game uses to encrypt and compress most of its important data, including the Item Proto, Mob Proto, and the EterPack index and content files. This post breaks down the format structure, the known encryption keys, and how the compression works.

What is a CryptedObject?

A CryptedObject is a Metin2 internal file format used to crypt and compress raw file data. It is currently used for the following files: Item Proto, Mob Proto, EterPack Index, and EterPack Content with type 2 and 6.

The format contains a 20-byte header followed by the content (either crypted or compressed) of the data.

Header structure

The 20-byte header is laid out as follows:

• Bytes 0-3 (red): a FourCC code that identifies the type of object. Known codes are MCOZ (LZO 1x compression) and MCSP (Snappy compression).
• Bytes 4-7 (blue): size of the data after being crypted. If this is 00 00 00 00, the data is not crypted.
• Bytes 8-11 (green): size of the data after being compressed.
• Bytes 12-15 (yellow): size of the data without any cryptation or compression (the real data size).
• Bytes 16-19 (black): crypted FourCC code, used to verify if the XTEA decryption was successful. If the object is not crypted, these bytes contain the plain FourCC.

Compression algorithms

The data is compressed by one of two algorithms based on the FourCC code:

• MCOZ: LZO 1x compression
• MCSP: Snappy compression

Encryption: XTEA and known keys

If the blue bytes (crypted size) are non-zero, the data is encrypted with the XTEA algorithm. Each type of file uses a different 16-byte key:

• Item Proto:

  Code: Select all

  A1 A4 02 00 AA 15 54 04 E7 8B 5A 18 AB D6 AA 01

• Mob Proto:

  Code: Select all

  46 74 49 00 0B 4A 00 00 B7 6E 08 00 9D 18 68 00

• EterPack Index:

  Code: Select all

  B9 9E B0 02 6F 69 81 05 63 98 9B 28 79 18 1A 00

• EterPack Content:

  Code: Select all

  22 B8 B4 04 64 B2 6E 1F AE EA 18 00 A6 F6 FB 1C

These keys are publicly known and are the reason tools like EterNexus can open official packs. Private servers often change these keys to keep casual tools out.

The Item Proto format

The Item Proto is a crypted file that contains all information about the items in the game. It is present in both the client and the server. On the server, it is used to process all item actions (equipping, trading, etc.). On the client, it is used for client-side checks and to display item information.

The Item Proto must be in one of two formats: MIPX or MIPT. The client can load a MIPT Item Proto (references exist in the binary), but no MIPT proto has ever been found in a public client. MIPX is the format you will actually encounter.

The MIPX format starts with a FourCC (MIPX), a version field (generally 1), a stride value (size of the structure that contains the items), the number of elements, the size of the Crypted Object data, and then the Crypted Object data itself.

Working with CryptedObject files

If you want to write your own tool to read or modify these files, the basic workflow is:

• Read the 20-byte header.
• Check the crypted size field. If non-zero, decrypt the data using XTEA with the appropriate key.
• Check the FourCC code. If MCOZ, decompress with LZO 1x. If MCSP, decompress with Snappy.
• Parse the resulting data according to the file type (Item Proto, Mob Proto, etc.).

A kaitai structure file for reading this format is available on the Metin2Dev documentation site, which can save you the trouble of writing a parser from scratch.

Sources
[1] Metin2Dev: Crypted Object format documentation
[2] Metin2Dev: File Formats overview
[3] EterNexus: Metin2 archive manager (MIT license)