《轩辕剑柒》的解包KEY为：oaddprYiOBCna/6pjaTOXNgCauDe7s3M7xrHF0Dy/FA

将解包KEY写到Crypto.json中即可用UnrealPakTool进行解包了。

解包出来的uasset模型可以用UE Viewer进行查看，也可参照这篇文章将模型导入UE4进行编辑，轩七的UE4版本号为4.24.3，查看和编辑时注意选择。

【下载地址】：点击下载（解压密码：bbqisdelicious）

【使用方法】：解压到《汉之云》v1.02简体版游戏目录覆盖即可，运行SwdHC.exe启动游戏。

仙剑6的DLC幻字灰色补丁上次被误删了，趁这次机会把原理写下来

补丁原理就是librivet.dll里面有个导出函数Rivet_DlcVerification，DLC进不去、幻字灰色都是因为这个函数返回0导致的，解决办法很简单，把函数入口代码改成：
mov eax, 1
retn

点击下载成品

IDA打开libmono.so（位于lib\x86\libmono.so，x86较arm方便分析），找到mono_image_open_from_data_with_name函数，注意这里有一个GetKey函数

F5分析代码，程序将GetKey函数返回的结果作为src然后memcpy，再新建一个image结构体并将dest赋值到image.raw_data，最后调用do_mono_image_load，根据这个逻辑GetKey返回的应是解密后的Assembly，跟进GetKey函数后发现该函数调用了一个名为EnDeCrypt的函数，从字面意思理解其应为解密函数，IDA已经给出了注释：

.mytext:00282CC8                 mov     [esp+8], edx    ; s
.mytext:00282CCC                 mov     [esp+4], eax    ; size
.mytext:00282CD0                 mov     eax, [ebp+arg_0]
.mytext:00282CD3                 mov     [esp], eax      ; int
.mytext:00282CD6                 call    EnDeCrypt

其中s为字符串mrd2cyou147852369，由于GetKey返回是解密后的Assembly数据，故这里推测int应是加密原始数据的指针，size则是原始加密数据的大小

基于上面，下面开始编写解密程序，由于so用的是x86版本，因此可直接将代码拷贝出来并进行调用；EnDecrypt函数共有4个CALL调用：_x86_get_pc_thunk_bx、strlen、malloc、swapints，其中swapints代码位置刚紧跟EnDecrypt，因此无需处理（因为相对地址不变），_x86_get_pc_thunk_bx直接nop去掉，strlen、malloc用相应函数链接（必须为cdecl）即可

以下是Delphi核心解密代码：

var
  DecCode: array[0..585] of byte = (
	$55, $89, $E5, $53, $8D, $A4, $24, $CC, $F7, $FF, $FF, $E8, $69, $38, $D9, $FF, 
	$81, $C3, $58, $81, $10, $00, $C7, $45, $EC, $00, $00, $00, $00, $C7, $45, $E8, 
	$00, $00, $00, $00, $8B, $45, $10, $89, $04, $24, $E8, $F9, $28, $D9, $FF, $89, 
	$45, $E4, $C7, $45, $F4, $00, $00, $00, $00, $EB, $36, $8B, $45, $F4, $89, $C2, 
	$C1, $FA, $1F, $F7, $7D, $E4, $89, $D0, $89, $C2, $8B, $45, $10, $8D, $04, $02, 
	$0F, $B6, $00, $0F, $BE, $D0, $8B, $45, $F4, $89, $94, $85, $DC, $F7, $FF, $FF, 
	$8B, $45, $F4, $8B, $55, $F4, $89, $94, $85, $DC, $FB, $FF, $FF, $83, $45, $F4, 
	$01, $81, $7D, $F4, $FF, $00, $00, $00, $7E, $C1, $C7, $45, $F4, $00, $00, $00, 
	$00, $C7, $45, $F0, $00, $00, $00, $00, $EB, $4F, $8B, $45, $F4, $8B, $94, $85, 
	$DC, $FB, $FF, $FF, $8B, $45, $F0, $01, $C2, $8B, $45, $F4, $8B, $84, $85, $DC, 
	$F7, $FF, $FF, $01, $C2, $89, $D0, $C1, $F8, $1F, $C1, $E8, $18, $01, $C2, $0F, 
	$B6, $D2, $29, $C2, $89, $D0, $89, $45, $F0, $8B, $45, $F0, $89, $44, $24, $08, 
	$8B, $45, $F4, $89, $44, $24, $04, $8D, $85, $DC, $FB, $FF, $FF, $89, $04, $24, 
	$E8, $EB, $00, $00, $00, $83, $45, $F4, $01, $81, $7D, $F4, $FF, $00, $00, $00, 
	$7E, $A8, $8B, $45, $0C, $89, $04, $24, $E8, $6B, $29, $D9, $FF, $89, $45, $E0, 
	$C7, $45, $F4, $00, $00, $00, $00, $E9, $AB, $00, $00, $00, $8B, $45, $EC, $89, 
	$C2, $83, $C2, $01, $89, $D0, $C1, $F8, $1F, $C1, $E8, $18, $01, $C2, $0F, $B6, 
	$D2, $29, $C2, $89, $D0, $89, $45, $EC, $8B, $45, $EC, $8B, $94, $85, $DC, $FB, 
	$FF, $FF, $8B, $45, $E8, $01, $C2, $89, $D0, $C1, $F8, $1F, $C1, $E8, $18, $01, 
	$C2, $0F, $B6, $D2, $29, $C2, $89, $D0, $89, $45, $E8, $8B, $45, $E8, $89, $44, 
	$24, $08, $8B, $45, $EC, $89, $44, $24, $04, $8D, $85, $DC, $FB, $FF, $FF, $89, 
	$04, $24, $E8, $69, $00, $00, $00, $8B, $45, $EC, $8B, $94, $85, $DC, $FB, $FF, 
	$FF, $8B, $45, $E8, $8B, $84, $85, $DC, $FB, $FF, $FF, $01, $C2, $89, $D0, $C1, 
	$F8, $1F, $C1, $E8, $18, $01, $C2, $0F, $B6, $D2, $29, $C2, $8D, $02, $8B, $84, 
	$85, $DC, $FB, $FF, $FF, $89, $45, $DC, $8B, $55, $F4, $8B, $45, $E0, $01, $C2, 
	$8B, $4D, $F4, $8B, $45, $08, $8D, $04, $01, $0F, $B6, $08, $8B, $45, $DC, $31, 
	$C8, $88, $02, $83, $45, $F4, $01, $8B, $45, $F4, $3B, $45, $0C, $0F, $8C, $49, 
	$FF, $FF, $FF, $8B, $45, $E0, $8D, $A4, $24, $34, $08, $00, $00, $5B, $5D, $C3, 
	$55, $8D, $2C, $24, $8D, $64, $24, $F0, $8B, $45, $0C, $89, $C2, $C1, $E2, $02, 
	$8B, $45, $08, $8D, $04, $02, $8B, $00, $89, $45, $FC, $8B, $45, $0C, $89, $C2, 
	$C1, $E2, $02, $8B, $45, $08, $01, $C2, $8B, $45, $10, $89, $C1, $C1, $E1, $02, 
	$8B, $45, $08, $8D, $04, $01, $8B, $00, $89, $02, $8B, $45, $10, $89, $C2, $C1, 
	$E2, $02, $8B, $45, $08, $01, $C2, $8B, $45, $FC, $89, $02, $C9, $C3, $55, $89, 
	$E5, $53, $8D, $64, $24, $DC, $E8, $5E, $36, $D9, $FF, $81, $C3, $4D, $7F, $10, 
	$00, $8D, $83, $54, $F7, $F3, $FF, $89, $45, $F4, $8B, $45, $0C, $8B, $55, $F4, 
	$89, $54, $24, $08, $89, $44, $24, $04, $8B, $45, $08, $89, $04, $24, $E8, $BD, 
	$FD, $FF, $FF, $8D, $64, $24, $24, $5B, $5D, $C3
  );

function myStrLen(szData: PChar): DWORD; cdecl;
begin
   result := StrLen(szData);
end;

function myMalloc(dwSize: DWORD): DWORD; cdecl;
begin
   result := DWORD(VirtualAlloc(nil, dwSize, MEM_COMMIT, PAGE_READWRITE));
end;

var
   pData, decData          : Pointer;
   fsStream                : TFileStream;
   pCode                   : Pointer;
   dwLen                   : DWORD;
   decFunc                 : function(pData: Pointer;
                                      dwSize: DWORD;
                                      szKey: PChar): Pointer; cdecl;
begin
   pCode := VirtualAlloc(nil, $1C0, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
   FillChar((@DecCode[$B])^, 5, $90);
   DWORD((@DecCode[$2B])^) := DWORD(@myStrLen) - (DWORD(pCode) + $2F);
   DWORD((@DecCode[$E9])^) := DWORD(@myMalloc) - (DWORD(pCode) + $ED);
   CopyMemory(pCode, @DecCode[0], $24A);
   @decFunc := pCode;

   fsStream := TFileStream.Create('H:\Assembly-CSharp.dll', fmOpenRead);
   dwLen := fsStream.Size;
   GetMem(pData, dwLen);
   fsStream.ReadBuffer(pData^, dwLen);
   fsStream.Free;
   
   decData := decFunc(pData, dwLen, 'mrd2cyou147852369');

   fsStream := TFileStream.Create('H:\Assembly-CSharp.decrypt.dll', fmCreate);
   fsStream.WriteBuffer(decData^, dwLen);
   fsStream.Free;
end;

【下载地址】点击下载

控制台是否开启由一个被写死的变量showConsole决定，默认为关闭状态（见图）

如需开启控制台，就必须将showConsole设为true，由于目前手里游戏版本不太齐全，因此就没有单独做工具，这里单独发一下开启仙剑6控制台的方法：
1、用WinHEX打开Pal6_Data\Managed\Assembly-CSharp.dll
2、打开16进制搜索（搜索->查找16进制数值），通配符填写FF，搜索1680FFFFFFFF1F0F

3、将16改为17，然后保存即可生效；如果需关闭控制台，则将17改回16即可（关闭控制台在第二步搜索也需要相应的搜索1780FFFFFFFF1F0F）

【下载地址】点此下载

【注意事项】
1、封包文件压缩与否是由游戏程序决定，不是由PKG决定，因此请务必保持压缩选项与原PKG包一致（是否压缩可以用PKGExtractor查看）
2、除了UI.pkg的文件类型为6，其余PKG文件类型均为1
3、游戏脚本script.pkg中文件只能为DFA加密文件，放入未加密文件则无法读取，另PKGExtractor2.5.2以前版本有解压BUG，解压后重新封包也无法读取，2.5.3版已修复此问题

【软件截图】

【文件列表】
V1.10更新文件：

Pal6_Data\Data\Mission
Pal6_Data\Data\Property\Character.dat
Pal6_Data\Data\Property\Fight.dat.0
Pal6_Data\Data\Property\Fight.dat.1
Pal6_Data\Data\Property\HPMPDP.dat.0
Pal6_Data\Data\Property\HPMPDP.dat.1
Pal6_Data\Data\Property\Monster.dat
Pal6_Data\Data\Property\monsterGroupData.txt
Pal6_Data\Data\Property\RanFangContainer.dat
Pal6_Data\Data\Property\skillData.txt
最近较忙更新晚了，不好意思~

V1.08更新文件：

Pal6_Data\Data\Mission
Pal6_Data\Data\Property\Character.dat
Pal6_Data\Data\Property\Fight.dat.0
Pal6_Data\Data\Property\Fight.dat.1
Pal6_Data\Data\Property\Fight.dat.2
Pal6_Data\Data\Property\HPMPDP.dat.0
Pal6_Data\Data\Property\HPMPDP.dat.1
Pal6_Data\Data\Property\HPMPDP.dat.2
Pal6_Data\Data\Property\Mission
Pal6_Data\Data\Property\Monster.dat
Pal6_Data\Data\Property\monsterGroupData.txt
Pal6_Data\Data\Property\skillData.txt
Pal6_Data\Data\Property\SocialNPC.dat
注：V1.08新版battlefield.txt文件编码由Unicode转为ASCII，内容无变化

V1.06更新文件：

Pal6_Data\Data\Mission
Pal6_Data\Data\Property\Character.dat
Pal6_Data\Data\Property\Fight.dat.0
Pal6_Data\Data\Property\Fight.dat.1
Pal6_Data\Data\Property\HPMPDP.dat.0
Pal6_Data\Data\Property\HPMPDP.dat.1
Pal6_Data\Data\Property\Monster.dat
Pal6_Data\Data\Property\monsterGroupData.txt
Pal6_Data\Data\Property\SocialNPC.dat

V1.04更新文件：

Pal6_Data\Data\Mission
Pal6_Data\Data\Property\SocialNPC.dat

V1.03全部解密文件：

Pal6_Data\Data\Mission
Pal6_Data\Data\npcdata
Pal6_Data\Data\RenownData.dat
Pal6_Data\Data\Property\battlefieldData.txt
Pal6_Data\Data\Property\Character.dat
Pal6_Data\Data\Property\Element5.dat
Pal6_Data\Data\Property\Fight.dat.0
Pal6_Data\Data\Property\Fight.dat.1
Pal6_Data\Data\Property\Fight.dat.2
Pal6_Data\Data\Property\formationData.txt
Pal6_Data\Data\Property\HPMPDP.dat.0
Pal6_Data\Data\Property\HPMPDP.dat.1
Pal6_Data\Data\Property\HPMPDP.dat.2
Pal6_Data\Data\Property\ItemContainer.dat
Pal6_Data\Data\Property\Monster.dat
Pal6_Data\Data\Property\monsterData.txt
Pal6_Data\Data\Property\monsterGroupData.txt
Pal6_Data\Data\Property\Pet.txt
Pal6_Data\Data\Property\PetBook.txt
Pal6_Data\Data\Property\PickUpItemContainer.dat
Pal6_Data\Data\Property\Player.dat
Pal6_Data\Data\Property\PlayerBase.dat
Pal6_Data\Data\Property\RanFangContainer.dat
Pal6_Data\Data\Property\skillData.txt
Pal6_Data\Data\Property\SocialNPC.dat
Pal6_Data\Data\Property\SoulStar.dat
Pal6_Data\Data\Property\statusData.txt
Pal6_Data\Data\Property\UnitSEIDPath.txt
Pal6_Data\Data\Property\UnitSEIDPathPrefab.txt

【注意事项】
1、千万不能转换文件编码，否则将导致游戏黑屏！
2、请在游戏根目录进行解压，解压后应该会在wuxia_Data\Config\Textfiles\释放684个txt文件，没有则说明解压位置不正确，修改这些txt文件就可以实现MOD效果
3、自1.0.2.2版开始Mod目录更换为：”Mods/”+GameGlobal.m_strVersion+”/Config/TextFiles/”+fileName+”.txt”

【下载地址】
点击下载（1.0.2.2版）
点击下载（1.0.2.1版）
点击下载（1.0.1.7版）
点击下载（1.0.1.4版）
点击下载（1.0.1.3版）

点击下载（1.0.1.7版解密后的pk文件-TextFiles_chs.pk、EffectText.pk）

【效果截图】

【下载地址】点击下载

【软件截图】