Weird PNG files?

[supersmashball]

So I'm trying to get all the sprites from this game called Pocket All Star Smash Bros. (A Chinese game).

I extract the apk, find the files. They're all PNG but cannot be view?

And sorry, cannot link.

[puggsoy]

They seem to be compressed or obfuscated in some way, unfortunately I'm not sure what to do though. Some parts of the file seem intact but that's about all I can make out, sorry :/

Here's a sample of files for anybody else who wants to take a gander.

[Garamonde]

Yea, for future reference, please upload some sample files for us to check to make our lives easier.

[Skyla Doragono]

I'll see if I can take a look later; sounds like something I've encountered before.

[supersmashball]

Thanks everyone! I appreciate the help!!!

[Skyla Doragono]

Hunh... I don't think this is an actual png file? It might be a container that just happens to use .png. Either way, I can't find a header for it, and all I'm seeing is garbage in any program that can actually open it.

[supersmashball]

Anything yet?

[shadowman44]

From what I've tried. I went onto this "file type checker" website to see what the file actually was, so the result was it's not actually a PNG. It was either something like a ".img", ".bin", ".iso" etc. I've tried changing the file extension to those and going on dodgy file converting websites, they still wouldn't convert it to PNG. Hope you can solve this soon!

[Raccoon Sam]

This is an interesting case. puggsoy is right, these are in fact real PNG files but under some obfuscation. For comparison's sake, here's the first 18 bytes of a valid PNG and the ones seen in the game's a11.png:

valid: 89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52 00 00
apk's: 89 50 41 88 0D 0A 15 C5 00 00 0F C2 49 48 4B 9D 00 00
diffs: 00 00 0D 59 00 00 05 BB 00 00 0F B5 00 00 07 4B 00 00

It appears that the first two bytes are okay, then two bytes of strangeness. Then two bytes of okay again, and two bytes screwed up again, etc. etc.

I'm trying to figure something out.

EDIT: the smallest file is arrow_attack.png. Its bytes are as follows (confirmed valid bytes bolded)
00: 89 50 4E 36 0D 0A 1A 7B 00 00 00 7C 49 48 44 23
10: 00 00 00 60 00 00 00 60 01 03 00 71 00 01 A3 A4
20: B9 00 00 71 04 67 41 3C 41 00 00 C0 8F 0B FC 10
30: 05 00 00 71 01 73 52 36 42 00 AE BF 1C E9 00 71
40: 00 03 50 4C 54 45 FF 00 00 19 E2 09 37 00 00 00
50: 0C 49 44 41 54 08 D7 63 60 A0 1C 00 00 00 44 00
60: 01 06 C0 57 A2 00 00 00 00 00 00 00 41 00 00 08
70: 71

I dunno, it has a mangled IHDR chunk header, but the PLTE and IDAT chunk headers are okay. Could be just a coincidence.
I can't find a IEND terminator in any of the PNGs though.

tdlr: they're pngs but they've been run through some kind of an obfuscator.

EDIT2: assets/res/images/icon/story/r10004.PNG is still unobfuscated



SUPER EDIT:
okay, i found strings and files relating to Cocos2D framework in the files. Apparently, someone from China has made a PNG encrypter/decrypter that's compatible with Cocos2D to some extent.
So, I guess they're encrypted with that. Dunno the keys though.

[supersmashball]

This is an interesting case. puggsoy is right, these are in fact real PNG files but under some obfuscation. For comparison's sake, here's the first 18 bytes of a valid PNG and the ones seen in the game's a11.png:

valid: 89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52 00 00
apk's: 89 50 41 88 0D 0A 15 C5 00 00 0F C2 49 48 4B 9D 00 00
diffs: 00 00 0D 59 00 00 05 BB 00 00 0F B5 00 00 07 4B 00 00

It appears that the first two bytes are okay, then two bytes of strangeness. Then two bytes of okay again, and two bytes screwed up again, etc. etc.

I'm trying to figure something out.

EDIT: the smallest file is arrow_attack.png. Its bytes are as follows (confirmed valid bytes bolded)
00: 89 50 4E 36 0D 0A 1A 7B 00 00 00 7C 49 48 44 23
10: 00 00 00 60 00 00 00 60 01 03 00 71 00 01 A3 A4
20: B9 00 00 71 04 67 41 3C 41 00 00 C0 8F 0B FC 10
30: 05 00 00 71 01 73 52 36 42 00 AE BF 1C E9 00 71
40: 00 03 50 4C 54 45 FF 00 00 19 E2 09 37 00 00 00
50: 0C 49 44 41 54 08 D7 63 60 A0 1C 00 00 00 44 00
60: 01 06 C0 57 A2 00 00 00 00 00 00 00 41 00 00 08
70: 71

I dunno, it has a mangled IHDR chunk header, but the PLTE and IDAT chunk headers are okay. Could be just a coincidence.
I can't find a IEND terminator in any of the PNGs though.

tdlr: they're pngs but they've been run through some kind of an obfuscator.

EDIT2: assets/res/images/icon/story/r10004.PNG is still unobfuscated



SUPER EDIT:
okay, i found strings and files relating to Cocos2D framework in the files. Apparently, someone from China has made a PNG encrypter/decrypter that's compatible with Cocos2D to some extent.
So, I guess they're encrypted with that. Dunno the keys though.

Pretty extensive for such a nice game.
Is there any way to test it out?

[supersmashball]

Bump?