This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=473

raykingnihong, posted Sun Dec 28, 2014 7:29 pm (2361)

---

This is an encrypted XML files and guessing is FLV or SWF files. How to decrypt, ask God to help here is a sample file https://onedrive.live.com/redir?resid=6 ... file,xml

aluigi, posted Sun Dec 28, 2014 8:46 pm (2366)

---

The file is simply xored with 0x05.
You can use my xor tool or the following script:

Code:

get NAME basename
get SIZE asize
get XOR_VALUE byte
savepos OFFSET
math SIZE -= OFFSET
filexor XOR_VALUE
getdstring EXT 3
string NAME  = "."
string NAME  = EXT
log NAME OFFSET SIZE

*script updated to work with any file*

raykingnihong, posted Mon Dec 29, 2014 6:39 am (2371)

---

aluigi wrote:

The file is simply xored with 0x05.
You can use my xor tool or the following script:

Code:

get NAME basename
string NAME  = ".flv"
get SIZE asize
filexor 0x05
log NAME 0 SIZE

My good friend, thank you very much for your help, I am testing the script and FLV files are extracted. But that doesn't play FLV video files, FLV video I compared the other seems different here are sample https://onedrive.live.com/redir?resid=6 ... =folder,

aluigi, posted Mon Dec 29, 2014 8:36 am (2374)

---

Probably they are modified to avoid playback but the xoring is correct.

raykingnihong, posted Tue Dec 30, 2014 5:25 am (2385)

---

Thank you, my friends, thank you for your help

MerlinSVK, posted Tue Dec 30, 2014 11:22 am (2387)

---

That FLV is playable. Just delete first 0x00 byte.

aluigi, posted Tue Dec 30, 2014 12:03 pm (2392)

---

Well done, I have updated the script accordingly