This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=7064

pravda, posted Sat Dec 09, 2017 11:01 am (30617)

---

Hi all,

Thanks to luigi for his great work

i've tried many script to decrypt this file but nothing.

Any help will be really great.

Regards.

aluigi, posted Sat Dec 09, 2017 11:04 am (30618)

---

Name of the game/software?

pravda, posted Sat Dec 09, 2017 11:07 am (30619)

---

Hi,

Thank you very much for your quick response.

the game is word charm , built with coco2d.

Need the apk ?

Regards.

aluigi, posted Sat Dec 09, 2017 12:06 pm (30626)

---

If someone will work on that, he needs at least the lib that contains the xxtea key

pravda, posted Mon Dec 11, 2017 8:17 am (30665)

---

Hi ,

i upload the libgame.so to ida and search xxtea and found this :

_DWORD __fastcall cocos2d::CCLuaStack::setXXTEAKeyAndSign(size_t size, const char *, int, const char *, int)
EXPORT _ZN7cocos2d10CCLuaStack18setXXTEAKeyAndSignEPKciS2_i
ZN7cocos2d10CCLuaStack18setXXTEAKeyAndSignEPKciS2_i

I don't know how to use it.

Luigi, did you need the libgame.so file ?

Thanks for help.

Regards.

aluigi, posted Tue Dec 12, 2017 8:06 pm (30706)

---

I guess the key is "8VVTJ-UC2R1" but the xxtea_decrypt functions available online fail miserably for some unknown reasons, didn't investigate.

pravda, posted Wed Dec 13, 2017 8:03 am (30719)

---

Hi,

Thank you for your help.

did you have any script ( quickbms ) that can be used to decrypt this ?

Regards

aluigi, posted Wed Dec 13, 2017 10:52 am (30723)

---

no

aluigi, posted Mon Jan 15, 2018 2:38 pm (31565)

---

http://aluigi.org/bms/word_charm.bms

pravda, posted Mon Jan 15, 2018 5:31 pm (31575)

---

Hi man,

Thank you very much . it work like a charm

jessijung, posted Sun Sep 16, 2018 3:42 am (38447)

---

aluigi wrote:

http://aluigi.org/bms/word_charm.bms

# Word Charm XXTEA decrypter
# script for QuickBMS http://quickbms.aluigi.org

set KEY string "8VVTJ-UC2R1"
encryption xxtea KEY "0x9e3779b9 0" 0 16 # cocos2d

idstring "XXTEA"
savepos OFFSET
get SIZE asize
math SIZE - OFFSET
get NAME filename
log NAME OFFSET SIZE

how to encrypt it again? thank so much

aluigi, posted Sun Sep 16, 2018 11:10 am (38452)

---

Code:

get NAME filename
string NAME   ".encrypt"
set MEMORY_FILE string "XXTEA"
log NAME 0 5 MEMORY_FILE
set KEY string "8VVTJ-UC2R1"
encryption xxtea KEY "0x9e3779b9 0" 1 16    # cocos2d
get SIZE asize
append
log NAME OFFSET SIZE
append