This is going to be a somewhat long and scattered post of what I currently know about the game.

Overview

• Install Path: %STEAMAPPS%\common\hololiveDreams
• Primary Entrypoint: hololive-Dreams.exe
• Developer: Qualiart, Inc. (株式会社)
• Engine: Unity
• Middleware: Live2D, Criware
• Anticheat: Kernel Driver

The game uses IL2CPP for the Unity code and the global-metadata.dat is encrypted.

Qualiart also makes another game using similar frameworks called Idoly Pride. Someone created a program to decrypt the assets for that game but they seem to have changed the format.

Basic Asset Dump

Attempting to run the game through AssetExplorer and the like does not work due to the assets being encrypted.

ILP2CPP decompilers also fail due to the metadata for it (global-metadata.dat) also being encrypted.

Until I can somehow find a way to get the AES key from memory, asset dumpers will not work.

Entrypoint

The entry executable (hololive-Dreams.exe) is just a simple wrapper that decrypts the actual executable stored as hololive-Dreams.exe._

Execution is done in memory using RWX pages, so there are no temporary files left on disk.

Encryption

ALL encryption in this game (including the executable) is just plain raw AES, no headers.

All the executable code in the game that is unencrypted is protected by some sort of memory guard for Ghirda fails to fully decompile it.

The game assets seem to be decrypted by the functions provided by fastaes_universal.dll, which is compiled with Rust.

Removing the DLL results in no change, so I’m unsure of what function provides the decryption.

Asides from the fastaes_universal.dll file, the assets have high entropy and are all “random” data, which is sterotypical for encrypted data.

Assets

The assets that are downloaded during the initial game execution (and thereafter) are all raw AES as well, and seem to be compressed with Brotli judging from the inclusion of Brolti decompression functions.

Plugins

The various plugins of interest, specifically the AES decryption plugin and the Criware middleware have symbols left in.

Just for fun, I removed the Criware Unity API dll and loaded the game. It successfully passed integrity checks and authenticated with the anticheat, but the game loaded to a blank white screen.

This was expected as the UI is drawn with Criware.

I also modified a random symbol (criAtomExPlayback_Stop) and renamed it, this function is responsible for stopping audio playback of a playing “track”.

The game passed integrity checks and started, but mostly locked up when retrying a failed live. Input still worked and flashed the rows so it isn’t completely locked up.

Modloaders?

The game detects attempts to add a mod loader (such as MelonLoader) and fails to start, BUT the plugins can be modified without issue.

My initial intent here was to create a mod to hook asset decryption attempts or audio loading attempts.

Anticheat

The game also has a kernel level anticheat (KLAC) driver it installs on Windows, as such, the game does NOT run on non-Windows platforms.

It is called usrdrv017964.sys and communicates with the game via \Device\Htsysm6321.

Not much is known about what exactly this driver is as it is not a standard driver, however, it checks something regarding the process tree of the game executable.

For fun I used x64dbg and force closed the handle to the driver, as expected, the game crashed within a few seconds as it continously polls the driver judging from IRPMon dumps.

Virtual Machine?

As expected with most games with KLAC, it does not load in a virtual machine. Most games will yell at you with an error, but hololiveDreams just exits and does not decrypt the secondary executable.

x64dbg?

Shockingly, the game allows you to attach a debugger on it without any anti-debug attempts at first.

However, memory dumps fail and x64dbg cannot view any memory pages, even as administrator. I tried using CheatEngine and it’s DBVM, but that causes an instant kernel lockup.

Furthermore, I tried using aes-finder and it could not find any keys. In fact, just like x64dbg, it could not read the memory even as administrator.

Stay tuned for more? who knows.

I might keep trying, but for now I’m taking a break because I spent the entire day working on this.