How to decrypt tjs files (kirikiri)?

[Kein]

I have been trying to do this for hours and I can't find a tool to do so, I have used GARBro to extract a startup.tjs out of data.xp3, but I have no clue what to do next to make the text readable. 

[frc_]

Does the file start with "TJS2" when you open it in a hex editor? In that case, it's not encrypted but compiled. As far as I know, there's only a disassembler for this format (giving you the list of virtual machine instructions), not a decompiler (giving you an approximation of the original .tjs script). That said, only few Kirikiri applications compile their TJS scripts; the only ones I know of are Nekopara and Emote Movie Maker.

If the file starts with the bytes "FE FE", though, it's a plain text script that got scrambled using one of the three algorithms supported by Kirikiri. I have a program that can reverse these, so let me know if you need it.

Edited October 29, 2018 by frc_

[Kein]

10 hours ago, frc_ said:

Does the file start with "TJS2" when you open it in a hex editor? In that case, it's not encrypted but compiled. As far as I know, there's only a disassembler for this format (giving you the list of virtual machine instructions), not a decompiler (giving you an approximation of the original .tjs script). That said, only few Kirikiri applications compile their TJS scripts; the only ones I know of are Nekopara and Emote Movie Maker.

If the file starts with the bytes "FE FE", though, it's a plain text script that got scrambled using one of the three algorithms supported by Kirikiri. I have a program that can reverse these, so let me know if you need it.

Sorry about the late reply back, this is a screenshot of it opened in a hex editor: 

There is no TJS2 or FE FE, any ideas on what I should do?

[frc_]

None of the standard obfuscation methods then. Have you tried extracting with KrkrExtract instead of GARbro?

[Kein]

3 minutes ago, frc_ said:

None of the standard obfuscation methods then. Have you tried extracting with KrkrExtract instead of GARbro?

KrkrExtract.exe gives me a virus warning on both FireFox and Chrome, they refuse to let the download pass.

[frc_]

Not your browser, but your antivirus is blocking the download. And yes, false positives are to be expected with a program like KrkrExtract - after all, the very feature which makes it work so well (messing with the game's code to make it decrypt its own files) is similar to what viruses do.

You can either temporarily disable your antivirus or ask someone else to do the extraction.