Skip to content

Android Client: Save Data Extraction Guide

This guide explains how to extract save data from the Android offline version of "KRFN" (v3.7.0). The extracted data can be imported into the Sparkle Fantasia custom server to migrate your characters (although some data like rooms, items, and weapons might be missing, character levels and basic progression can be restored).

Warning

To perform this extraction, you must meet one of the following requirements:

  • A rooted Android device
  • A BlueStacks emulator on Windows
  • A device from specific manufacturers (Xiaomi/ASUS) supporting complete application backup
  • A device vulnerable to CVE-2024-0044 (Android 12.0 - 14.0 with security patches older than March 2024)

If you do not meet any of these requirements, you will not be able to extract the save data automatically. In such cases, you will need to manually record your character statuses (e.g., via screenshots) and enter them manually.

Prerequisites: Setting up ADB (Android Debug Bridge)

Most extraction methods require ADB to connect to your Android device or emulator. Skip this step if you already have ADB installed.

  1. Download SDK Platform-Tools for Windows from Android Developers.
  2. Extract the downloaded archive to a convenient folder (e.g., C:\android-platform-tools).
  3. Add the extracted path to your system's Environment Variables (PATH).
  4. Verify the installation by opening Command Prompt (cmd) or PowerShell and running: 
    adb version
    If it prints Android Debug Bridge version 1.0.XX, the setup is successful.

Method A: BlueStacks Emulator (Automated Dumper)

If you are using the BlueStacks emulator, you can use a specialized tool to dump your offline save data automatically.

  1. Launch the BlueStacks emulator containing KRFN v3.7.0 (ensure the offline data has been created inside the app).
  2. Open BlueStacks Settings -> Advanced.
  3. Toggle the Android Debug Bridge (ADB) option to ON and save the changes.
  4. Restart the BlueStacks emulator.
  5. After restarting, open Settings -> Advanced again to locate the ADB port number (e.g., 55713). Keep this settings window open.
  6. Download the automated dumping tool: krr_offlinedata_dumper.zip from Google Drive.
    • Note: The zip archive password is password.
  7. Extract the archive and run krr_offlinedata_dumper.exe. (Allow any Windows security prompts if they appear).
  8. A console window will open. Enter the ADB port number displayed in your BlueStacks Settings (e.g., 55713) and press Enter.
  9. Once the process completes, a file named out.json will be generated in the same directory.
  10. Open out.json with a text editor (like Notepad) to verify it contains your save data.

Method B: Rooted Android Device (Manual Extraction)

For rooted Android devices, you must manually extract the database and encryption key from the system storage and decrypt them using a Python script.

  1. Install a root-enabled file explorer on your device (e.g., Solid Explorer).
  2. Copy the database encryption key file:
    • Source: /data/data/com.aniplex.kirarafantasia/files/key.d
    • Destination: /sdcard/ (or any easily accessible location on your internal storage)
  3. Copy the database file itself:
    • Source: /sdcard/Android/data/com.aniplex.kirarafantasia/files/o.d (Note: depending on the version/environment, it might also be located in /data/data/com.aniplex.kirarafantasia/files/o.d)
    • Destination: /sdcard/
  4. Transfer both key.d and o.d from your Android device to your PC.
  5. Create a Python script in the same directory as the transferred files. Use the script below to decrypt the save data.
    • Note: Ensure you have Python installed, along with the pycryptodome and msgpack libraries (pip install pycryptodome msgpack).
import json
import codecs
import msgpack
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad

# ファイルからデータを読み込む
o_d = open("o.d", "rb").read()
key = open("key.d", "rb").read()

# 最初の16バイトはAESの初期化ベクトル(IV)
iv = bytearray(o_d[:16])
enc_body = o_d[16:]

# AES-CBCモードで復号化する
decipher = AES.new(key, AES.MODE_CBC, iv)
dec_bytes_no_pad = decipher.decrypt(enc_body)
dec_bytes = unpad(dec_bytes_no_pad, block_size=AES.block_size)

# MessagePack形式をアンパックしてJSONに変換
save_data = msgpack.unpackb(dec_bytes)
save_data_json = json.dumps(save_data, indent=2)
out = codecs.decode(save_data_json, "unicode-escape")

# 出力ファイルに書き込む
with open("./out.json", "w", encoding="utf8") as f:
    f.write(out)
  1. Run the script. A file named out.json will be generated. Open and verify that it contains user data fields.

Method C: Built-in Backup & Restore (No Root - Supported Devices Only)

Certain Android manufacturers allow complete application data backups (including the normally inaccessible /data/data directory) without requiring root access.

Supported Manufacturers (Known to support complete data backup):

  • Xiaomi: Using "Local Backup"
  • ASUS: Using "ASUS Data Transfer"

Unsupported Manufacturers (Known to only back up empty app metadata):

  • Oppo / Sony / Google

Extraction Steps (Example for Xiaomi)

  1. Go to Settings -> My Device -> Back up and restore.
  2. Select Mobile device.
  3. Select only the KRFN app.
  4. Run the backup. Once completed, navigate to MIUI/Backup/AllBackup/ on your device's internal storage and find the generated .bak file.
  5. Transfer this .bak file to your computer.
  6. Rename the .bak file or open it as a .zip archive (you may need a standard archive extraction tool).
  7. Extract the archive and locate key.d and o.d inside the app folder structure.
  8. Decrypt the files using the Python script provided in Method B.

Method D: CVE-2024-0044 Vulnerability Exploit (No Root - Android 12.0 to 14.0)

If your device is running Android 12.0 to 14.0 (with a security patch level older than March 2024), you may be able to exploit the CVE-2024-0044 vulnerability to elevate privileges and extract the encrypted files without root access.

Note

This requires basic knowledge of Linux shell commands and Android debugging.

  • Vulnerability Details: CVE-2024-0044 allows an attacker with ADB access to read files in the private data directories of other apps due to improper permission checks in the shell command environment.
  • Reference Article: Extracting App Data using CVE-2024-0044
  • PoC Bypass: If standard methods fail, you can try this proof-of-concept repository: canyie/CVE-2024-0044

While direct file copying might fail due to access blocks, you can pipe the file stream outputs to your shared storage (/sdcard/) like this:

# CVE-2024-0044の特権昇格を利用してプライベート領域からファイルをパイプで書き出す例
cat /data/data/com.aniplex.kirarafantasia/files/key.d > /sdcard/key.d

(Note: Tested on Oppo Reno 5A and did not work; success varies depending on the device security patch level and manufacturer modifications).

Importing Save Data into Sparkle Fantasia

Once you have successfully generated your out.json file, you can import it into the custom server:

  1. Visit the Sparkle Fantasia Import Portal: Sparkle Fantasia Offline Import.
  2. Upload your out.json file.
  3. The server will issue a Transfer Code and a Password.
  4. Launch your custom game client and use these credentials to transfer your character data.

Important

  • This import feature is strictly designed for offline save data extracted from the official v3.7.0 client. It does not support importing server-side online save states.
  • Current Status: The self-service import page might currently be experiencing issues. If the import fails, please contact the administrator via Direct Message (DM) for manual import assistance.