Difference between revisions of "Piñata Vision barcode/Obfuscation set"

Latest revision as of 14:32, 26 February 2013

The Piñata Vision barcode article discusses obfuscation (of the barcode) in general.

Pinata Vision obfuscation

Obfuscation is the process of concealing the Piñata Vision card's data, making it difficult to interpret.

Deobfuscating (or obfuscating) card data involves two steps. First the card data is converted from barcode representation to obfuscated binary data. Next the obfuscated bits are deobfuscated by applying a logical transformation, negating various bits, then (re)shuffling them (back into their proper order).

Logical transformations

Using functions involving AND, OR, XOR (exclusive OR), and NOT, obfuscated bits can be transformed into more readable values.

In these examples, we'll represent obfuscated bits by w, x, y, and z, and the corresponding deobfuscated values by a, b, c, and d.

Given 4 bits of obfuscated data, and four functions to reverse the obfuscation, we see that:

• a = ^a(x) = (bit x)
• b = ^b(x y z) = (!bit x & !bit y | bit z ^ (bit x | bit y & bit z))
• c = ^c(x y z) = (!bit x | bit y | !bit z ^ (bit x & bit y | bit z))
• d = ^d(w x y z) = (!bit w | !bit x & !bit y ^ bit z)

Since the result for a particular translation is known (based on each possible input), we can replace the actual logical operations with a direct substitution of each translated value back to its original input value. I.e., tr 76543210EFABCD98 0-9A-F.

Bit shuffling

Bit shuffling makes it harder to spot sequences of bits, by rearranging the order of the bits. Given a sequence of bits wxyzwxyzwxyz..., the obfuscation could shuffle them in a variety of ways, such as wwwxxxyyyzzz...

Obfuscation sets

Using those variety of techniques, and by varying how bits are shuffled and negated for each obfuscation, the game can produce 16 different variations of obfuscated data. Each particular variation is called an obfuscation set (since all data in that set is obfuscated using the same variation). Having examined all 16 obfuscation sets for ID bits, each set sharing a common last byte uses the same columns for its obfuscated ID bits. (See the Choclodocus egg card article for an example of an obfuscation set's ID bit locations.)

Each obfuscation set is given a 4-bit value (related to a check digit) that identifies the specific obfuscation used to produce that obfuscated data. The game recognizes which particular obfuscation was used by examining the last byte of a barcode's row.

Multi-row cards

Based on the name example, each barcode row has its own trailing obfuscation set byte, and is obfuscated independently of other rows. For example, this accessorized Galagoogoo green variant has a 3-row barcode on its card. Its barcode is represented in hexadecimal as A2141426B00E1A42 B11F620521256E13 E02E7793D1F0E869. Notice that the last byte of each row happens to indicate a different obfuscation set, meaning that each row is obfuscated using a different technique from the other rows.

To deobfuscate this card, we'd have to deobfuscate row 1 by reversing the set 2 obfuscation method, deobfuscate obfuscation set 3 in row 2, and finally deobfuscate set 9 in the last row, before joining all the deobfuscated rows together to reveal the encoded data.

This seems like a complicated process, but it can be optimized by normalizing the obfuscations (i.e., shuffling and negating bits so that the obfuscated bits are once again returned to their original order and values, then transforming groups of bits back to the original encoded data.

Obfuscation set selection

The method of selecting an obfuscation for a row of encoded data involves computing a weighted checksum digit, similar to the EAN check digit. Alternating weights of 3 and 1 are used, with the 15th digit having a weight of 3. The weighted values are summed. The check digit is the value which when added to the sum yields a number evenly divisible by 16. (I.e., modulo 16 of the sum plus the check digit will equal 0.)

This 4-bit check digit maps to one of the 16 possible obfuscation sets.

Example calculation

Using the encoded (unobfuscated) data for a free Macaracoon life sweet as an example, compute a weighted value for each 4-bit digit by multiplying the (decimal) value of the hex digit by the weight.

The sum of the weighted values is 130. 14 would have to be added to the sum to make it evenly divisible by 16. I.e., (130 + 14) % 16 = 0, so the check digit is 14.

% egrep 'Generated_PlaceTag_Sweet_[prst]' barcodes.txt | ./barcodetxt2bitdiff.pl --short | ./checksum3.pl  | sort --key=3.17
Sweet_pony          	1725	A5F8F4664D0A5792 sum = 174 check =  2
Sweet_rabbit        	1727	A568F4664D0A57C2 sum = 222 check =  2
Sweet_spider        	1733	CBFFD156B86FC2E4 sum = 156 check =  4
Sweet_pig           	1721	DBF6D516F87BD0F4 sum = 172 check =  4
Sweet_snail         	1750	DB6FF154B97FC2E4 sum = 188 check =  4
Sweet_swan          	1735	CB6FD154B86FC2E4 sum = 204 check =  4
Sweet_poisonfrog    	1723	DB66D514F87BD0F4 sum = 220 check =  4
Sweet_redbutterfly  	1729	96FEDBAEAB02C656 sum = 154 check =  6
Sweet_sheep         	1731	96EADBAEAB02C656 sum = 202 check =  6
Sweet_sparrow       	1732	D76190A0ADE39B2B sum = 132 check = 12
Sweet_parrot        	1720	D76190A0AD58492B sum = 148 check = 12
Sweet_squirrel      	1734	D76190A0ADE3CB6B sum = 180 check = 12
Sweet_pigeon        	1722	D76190A0AD58696B sum = 196 check = 12
Sweet_pinkbutterfly 	1724	B57070E0C9170B3D sum = 150 check = 10
Sweet_purplebutterfl	1726	BA7070E039170B3D sum = 198 check = 10
Sweet_raccoon       	1728	F170696DC403538F sum = 130 check = 14

It doesn't matter if the row being obfuscated is row 1 or a different row. The game simply computes the check digit for the row of data to be obfuscated, regardless of what data is within that row. So, the game might be obfuscating accessory details or a pinata name, but that's all transparent to the obfuscation that's taking place.

Obfuscation set progression

As shown in the ID table, obfuscation sets alternate in two groups of four, and repeat a predictable sequence every 64 IDs. The following can be noted about the table:

1. Each group of four cards uses 2 different obfuscations. The even/odd IDs of the group only differ by a single unobfuscated bit (i.e., ID bit 1).
2. Every 16 IDs, the order within the group of four will alternate. E.g., the first group may start as A, B, A, B, but 16 cards later, their order will have changed to B, A, B, A.
3. Similarly obfuscated cards can always be located 2, 8, or 32 IDs away. (They can also be located 512, 1024, and 2048 IDs away, as the progression cycles through the different sets and restarts itself.) This is a key detail in finding similarly obfuscated (PlaceTag) cards that only differ by a single ID bit.

Interpolation of obfuscation set data

Due to the repeating pattern of similarly obfuscated cards appearing 2 cards apart, and possibly 8 (or 9) cards apart, if the obfuscation set appears in the next progression, it's possible to interpolate data for missing cards, based on the pattern of differing obfuscated bits seen 2 (or 8) cards apart.

This can be done by comparing a pair of cards (from the same obfuscation set) to see which obfuscated bits differ. For example, (PlaceTag) cards for IDs 309 and 311 from obfuscation set 96 6 show the following minor difference (as the card's unobfuscated data changes ID bit 1 from 0 to 1, the barcode's obfuscated data changes bits 52 and 50 from 01 to 10):

egrep "(0309|0311)" 96_no_banjostatue.txt | ./bit_diff.pl 
                                             55
Description            VPID Barcode          20
-----------------------------------------------
Egg_walrus             0309 926EDF96E548F4A6 01  0x0135 0b0000000100110101
Egg_whitebutterfly     0311 927ADF96E548F4A6 10  0x0137 0b0000000100110111

ID bit  1 to match 01
  Exact match(es): 52, !50

Once a specific pattern is recognized, it can be used to fill in a missing card's barcode, based on the barcode from a similarly obfuscated card located 2 cards away. This comparison method can also be applied to cards located further (e.g., 8 or 32 cards) away, as long as they're from the same obfuscation set.

This process could even be automated by a script that scans the ID table, makes comparisons between alternating cards to recognize a particular obfuscation set's specific patterns, then applies that pattern to fill in missing ID table card barcodes.

Decoding

Decoded obfuscation sets

• Obfuscation set 0
• Obfuscation set 1
• Obfuscation set 2
• Obfuscation set 3
• Obfuscation set 4
• Obfuscation set 5
• Obfuscation set 6
• Obfuscation set 7
• Obfuscation set 8
• Obfuscation set 9
• Obfuscation set A
• Obfuscation set B
• Obfuscation set C
• Obfuscation set D
• Obfuscation set E
• Obfuscation set F

Decoded columns for obfuscation sets

The different sets share a common manner of obfuscation, although each set's bits are shuffled and negated differently to give the appearance of significantly different obfuscations.