vdimgtool

Decrypt and key-recover Taito vdimg_ec arcade images. Reverse-engineered from the original Windows decryptor/bruteforcer and rewritten in Rust to build and run natively on NixOS.

Build

nix build            # -> ./result/bin/vdimgtool
nix run . -- <args>  # run without installing
nix develop          # dev shell (cargo, rustc, clippy)

Usage

# recover the key from the boot-sector signature (tries all keysets if omitted)
vdimgtool brute <in.img> [original|nesica|other]

# decrypt with a known key
vdimgtool decrypt <in.img> <out.img> <0xKEY> <original|nesica|other>

# brute + decrypt in one step
vdimgtool auto <in.img> <out.img> [original|nesica|other]

Streams arbitrarily large images; brute finishes in well under a second.

How it works (short version)

The 32-bit key is split into two 15-bit halves, each seeding a Numerical-Recipes ran3 PRNG. Their outputs interleave into a 2048-byte keystream that is XORed over the file; the nesica/other keysets add a per-2048-byte IV from tables lifted out of the original binary. Keys are brute-forced by anchoring on the decrypted DOS boot sector (EB xx 90 … 55 AA).

Verified

Both sample images decrypt with key 0x78054d02, keyset nesica: vdimg_ec.img → NTFS, eeui_ec.img → FAT12 (ORBITAL).