This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=362

barti, posted Sun Nov 09, 2014 2:57 pm (1668)

---

- link expired -

aluigi, posted Sun Nov 09, 2014 3:51 pm (1671)

---

It seems a sort of RC4 with key "\xcf\xe7\x43\xe8\xb1\xb3\x35\xa5", but there are some customizations.
The function to check "EncryptedXMLWriter::EncryptedXMLWriter(int, char *)".
Maybe I will check it later or someone else will (Ekey?).

Ekey, posted Mon Nov 10, 2014 10:32 pm (1711)

---

Hmmm. I think there is still one more encryption function. Look this > EncryptedXMLWriter::write(void const*,uint)

PseudoCode.rar

aluigi, posted Tue Nov 11, 2014 12:03 am (1715)

---

http://aluigi.org/papers/bms/others/rr3 ... writer.bms

And this is the source code:
http://aluigi.org/papers/bms/others/rr3 ... mlwriter.c

barti, posted Tue Nov 11, 2014 8:32 am (1722)

---

Thank you very much, works perfectly.

LolHacksRule, posted Sat Nov 02, 2019 9:02 pm (51848)

---

Hate rebumping an old topic like this but I cannot decrypt this GUI (XML) file (they changed the extension sometime IDK, they are funky) using the script, can someone help or point me to an alternative program/site/script for decrypting it?

LolHacksRule, posted Fri Dec 13, 2019 5:01 pm (52560)

---

Anything?

Ekey, posted Fri Dec 13, 2019 6:12 pm (52564)

---

This is not surprising. 5 years have passed since the topic was created. Perhaps the algorithm has changed or encryption key

LolHacksRule, posted Fri Dec 13, 2019 7:02 pm (52565)

---

Key is fine definitely, I can decrypt everything else with the same script. UPDATE: I can decrypt this fine NVM, maybe the QuickBMS update fixed it?