ZenHAX

Free Game Research Forum | Official QuickBMS support | twitter @zenhax | SSL HTTPS://zenhax.com
It is currently Mon Jan 27, 2020 10:58 pm

All times are UTC




Post new topic  Reply to topic  [ 9 posts ] 
Author Message
PostPosted: Sun Nov 09, 2014 2:57 pm 

Joined: Sun Nov 09, 2014 2:40 pm
Posts: 34
- link expired -


Last edited by barti on Fri Sep 02, 2016 12:15 pm, edited 1 time in total.

Top
   
PostPosted: Sun Nov 09, 2014 3:51 pm 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 10826
It seems a sort of RC4 with key "\xcf\xe7\x43\xe8\xb1\xb3\x35\xa5", but there are some customizations.
The function to check "EncryptedXMLWriter::EncryptedXMLWriter(int, char *)".
Maybe I will check it later or someone else will (Ekey?).


Top
   
PostPosted: Mon Nov 10, 2014 10:32 pm 

Joined: Sat Aug 09, 2014 2:34 pm
Posts: 919
Hmmm. I think there is still one more encryption function. Look this > EncryptedXMLWriter::write(void const*,uint)


Attachments:
PseudoCode.rar [1.16 KiB]
Downloaded 178 times
Top
   
PostPosted: Tue Nov 11, 2014 12:03 am 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 10826
http://aluigi.org/papers/bms/others/rr3 ... writer.bms

And this is the source code:
http://aluigi.org/papers/bms/others/rr3 ... mlwriter.c


Top
   
PostPosted: Tue Nov 11, 2014 8:32 am 

Joined: Sun Nov 09, 2014 2:40 pm
Posts: 34
Thank you very much, works perfectly.


Top
   
PostPosted: Sat Nov 02, 2019 9:02 pm 
User avatar

Joined: Fri Apr 20, 2018 12:41 am
Posts: 469
Hate rebumping an old topic like this but I cannot decrypt this GUI (XML) file (they changed the extension sometime IDK, they are funky) using the script, can someone help or point me to an alternative program/site/script for decrypting it?


Attachments:
OnlineMultiplayerBanner_foursquare.txt [8.55 KiB]
Downloaded 18 times

_________________
Hacking Angry Birds since 2016
Top
   
PostPosted: Fri Dec 13, 2019 5:01 pm 
User avatar

Joined: Fri Apr 20, 2018 12:41 am
Posts: 469
Anything?

_________________
Hacking Angry Birds since 2016


Top
   
PostPosted: Fri Dec 13, 2019 6:12 pm 

Joined: Sat Aug 09, 2014 2:34 pm
Posts: 919
This is not surprising. 5 years have passed since the topic was created. Perhaps the algorithm has changed or encryption key :)


Top
   
PostPosted: Fri Dec 13, 2019 7:02 pm 
User avatar

Joined: Fri Apr 20, 2018 12:41 am
Posts: 469
Key is fine definitely, I can decrypt everything else with the same script. UPDATE: I can decrypt this fine NVM, maybe the QuickBMS update fixed it?

_________________
Hacking Angry Birds since 2016


Top
   
Display posts from previous:  Sort by  
Post new topic  Reply to topic  [ 9 posts ] 

All times are UTC


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Powered by phpBB® Forum Software © phpBB Limited