Encrypted OFS3 Files?

[Lillyth-Sillyth]

I'm currently working on extracting character sprites, event illustrations, and dialogue backgrounds from Sword Art Online: Alicization Lycoris.
The game seems to use the exact same / very similar file types and folder structure as two of its predecessors (Sword Art Online: Hollow Fragment and Hollow Realization).
With the sprites / illustrations / backgrounds of the latter being packaged like this:

1. CPK File
   
2. OFS3 Files
   
3. PHYRE Files
   
4. DDS Files
   
5. PNG Files
   

For Lycoris, I managed to extract the CPK without problems, and even successfully extracted all cutscenes and sound files.
However, I am struggling with unpacking what should be OFS3 files. At first, I thought it was simply a different file type, or incorrectly extracted from the CPK.
The first line when opening it with an HEX editor (which usually should contain the phrase OFS3) only reads this gibberish [HEX Value > ASCII Value]:

• BC AD B6 B3 BE A6 B3 BE FF 64 B2 FF FF 3A F1 FF > ¼.¶³¾¦³¾ÿd²ÿÿ:ñÿ
  

And the entire rest of the file looks essentially the same - no clear information anywhere to be found.

However, when scrolling all the way to the bottom, I managed to find these lines [HEX Value > ASCII Value] :

• 4F 46 53 33 10 00 00 00 00 00 40 00 F0 9B 4D 00 > OFS3......@.ð›M.
  
• 4F 46 53 33 10 00 00 00 01 00 40 00 70 6A 27 00 > [email protected]'.
  
• 52 59 48 50 54 00 00 00 D7 08 00 00 31 31 58 44 > RYHPT...×...11XD
  

Those seem to indicate that the file is an OFS3 file after all. But unpacking it with my usual method (OFS3 Tool by Liquid-S from GitHub) does not work.
QuickBMS also could not extract them as a PHYRE file.

Since I am pretty new to this whole topic, I haven't encountered anything like this before.
My current theory is that the file might be encrypted to some degree, though I have no idea how to confirm this.

Have any of you ever seen something like this, and do you know if there is any way to get this thing unpacked?
I attached one of the affected files, so you can have a look for yourself.

  SpriteOFS3.zip (Size: 871.09 KB / Downloads: 25)
Would be really happy if anyone had some leads for me. And thanks in advance!

[axx1611]

I think they are not OFS3 RAW files, but OFS3 files compressed in CRILAYLA format.
and SAOAL's CRILAYLA format is also modified.
You need to XOR the first 32 bytes (I'm not sure if it is fixed 32 bytes) with 0xFF first (after XOR, you will see the CRILAYLA file header)

In addition, the reason why you can see the OFS3 word is because the CRILAYLA format does not compress the first 256 bytes but directly saves them at the end of the file.
I highly suspect that most of SAOAL's files have been processed in a similar way.

[Lillyth-Sillyth]

I think they are not OFS3 RAW files, but OFS3 files compressed in CRILAYLA format.
and SAOAL's CRILAYLA format is also modified.
You need to XOR the first 32 bytes (I'm not sure if it is fixed 32 bytes) with 0xFF first (after XOR, you will see the CRILAYLA file header)

In addition, the reason why you can see the OFS3 word is because the CRILAYLA format does not compress the first 256 bytes but directly saves them at the end of the file.
I highly suspect that most of SAOAL's files have been processed in a similar way.

Thank you so much! The XOR method worked, and I managed to get out a few of the sprites.
Some were corrupted, but I am pretty sure I can fix that by changing the amount of bytes I XOR.
I'm really so glad you knew how to get past this, thank you thank you thank you!

For anyone coming across this in the future, what I did was:

1. Use CriPakGUI to unpack the data.cpk
   
2. Copy the adv folder and subfolders
   
3. XOR the first 32 bytes of the files inside to decrypt the CRILAYLA header (maybe a different number of bytes will be necessary)
   
4. Patch the .cpk file
   
5. Unpack the modified .cpk file, which should show an OFS3 header in the files that were previously CRILAYLA
   
6. Use OFS3 Tool to unpack the OFS3 files
   
7. Use QuickBMS to unpack the PHYRE files
   
8. Use Noesis to extract the .dds files