ZenHAX

Free Game Research Forum | Official QuickBMS support | twitter @zenhax | SSL HTTPS://zenhax.com
It is currently Thu Nov 23, 2017 7:27 am

All times are UTC




Post new topic  Reply to topic  [ 3 posts ] 
Author Message
PostPosted: Mon Oct 16, 2017 1:44 pm 

Joined: Sun Sep 24, 2017 1:43 pm
Posts: 4
I think these files are XOR encrypted (I might be wrong). It looks like it's just adding/subtracting 3s and 1s in some pattern. Does it look possible to guess the encryption key?

Samples:
Attachment:
samples.zip [124.89 KiB]
Downloaded 7 times


Hex editor snippets:
Code:
b8 61 7f 76 3c 3b 2b 3b 31 31 31 3c 78 79 31 31 - start of encrypted .png files
89 50 4e 47 0d 0a 1a 0a 00 00 00 0d ?? ?? 00 00 - what I assume it corresponds to
Code:
31 31 31 78 74 7f 75 9f 73 51 b3 0a - end of encrypted .png files
00 00 00 49 45 4e 44 ae 42 60 82 ?? - what I assume it corresponds to


I also have assembly code from the 'encryptDecrypt' portion of the file that was probably used for the encryption...If the key can't be guessed from the samples, should I try reading this or is it a waste of time?
Code:
push %rbp
mov %rsp %rbp
sub $0x1b0,%rsp
mov %rdi,%rax
mov 0x630c(%rip),%c1 # 0x100006d90
mov %c1, -0x131(%rbp)
mov $0x0, -0x132(%rbp)
mov %rdi, 0x150(%rbp)
mov %rsi, 0x158(%rbp)
mov %rax, 0x160(%rbp)
callq func_100006554
Full executable: https://drive.google.com/open?id=0B2FK8VIu6fm2S0NZbkVnMTEwbms


Top
   
PostPosted: Mon Oct 16, 2017 9:57 pm 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 7132
xor 0x31

If you need a script:
Code:
get NAME filename
get SIZE asize
filexor 0x31
log NAME 0 SIZE


Top
   
PostPosted: Tue Oct 17, 2017 12:10 am 

Joined: Sun Sep 24, 2017 1:43 pm
Posts: 4
Thank you so much, it's perfect!


Top
   
Display posts from previous:  Sort by  
Post new topic  Reply to topic  [ 3 posts ] 

All times are UTC


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Powered by phpBB® Forum Software © phpBB Limited