This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=7455

Wouldubeinta, posted Fri Feb 23, 2018 4:08 am (32690)

---

Hi, I was wondering if someone can take a look at this file and tell what encryption this file is using. I believe it might be 128bit AES, not to sure, it looks like it's got some sort of table before the encryption.

EXE Log from Luigi's Signsrch:

Code:

 offset   num  description [bits.endian.size]
  --------------------------------------------
  40bbc0f4 3048 DMC compression [32.le.16&]
  40bbc54d 2417 MBC2 [32.le.248&]
  40bbc550 2418 MBC2 [32.be.248&]
  40c176c0 1996 rfc3548 Base 64 Encoding with URL and Filename Safe Alphabet [..62]
  40c17b80 3038 unlzx table_three [32.le.64]
  40c18410 2291 zinflate_lengthStarts [32.le.116]
  40c1848d 2295 zinflate_lengthExtraBits [32.be.116]
  40c18490 2294 zinflate_lengthExtraBits [32.le.116]
  40c18510 2298 zinflate_distanceStarts [32.le.120]
  40c1858d 2304 zinflate_distanceExtraBits [32.be.120]
  40c18590 2303 zinflate_distanceExtraBits [32.le.120]
  40c19718 2600 LZMA compression [..24]
  40c21900 874  SHA256 Hash constant words K (0x428a2f98) [32.le.256]
  40c21a00 876  SHA256 Initial hash value H (0x6a09e667UL) [32.le.32&]
  40c21a00 1030 SHA256 [32.le.288&]
  40c21a04 2364 Crypton kp [32.le.16]
  40c3d6f0 2005 B64EncodeTable [..64]
  40c3d8c8 1601 libavcodec ASF asf_header [..16]
  40c5d8c0 1723 asf_content_desc_guid [..16]
  40c5e1f0 839  ADPCM index table (step variation) [32.le.64]
  40c5e230 841  ima_adpcm step table [16.le.178]
  40c5f710 238  CRC-8-ATM [crc8.0xe0 le rev 1.256]
  40c5f710 231  CRC-8-ATM [crc8.0x07 lenorev int_min.256]
  40c5fdc0 1605 Generic bitmask table [32.le.128]
  40c5fdc4 2588 bitmask [32.le.128]
  40c5fe34 3051 compression algorithm seen in the game DreamKiller [32.be.12&]
  40c5fe37 3050 compression algorithm seen in the game DreamKiller [32.le.12&]
  40c5fe80 650  CRC-32-IEEE 802.3 [crc32.0xedb88320 le rev 1.1024]
  40c5fe80 639  CRC-32-IEEE 802.3 [crc32.0x04c11db7 lenorev int_min.1024]
  40c60360 1933 Vorbis FLOOR1_fromdB_LOOKUP [float.le.1024]
  40cd96a8 2545 anti-debug: IsDebuggerPresent [..17]
  40d4d800 1801 mp3lib intwinbase [32.le.1028]
  40d51c50 1800 mp3lib bandInfo [..2592]
  40d52670 1766 mp3lib huffman tab1 [16.le.14]
  40d52680 1768 mp3lib huffman tab2 [16.le.34]
  40d526a8 1770 mp3lib huffman tab3 [16.le.34]
  40d526d0 1772 mp3lib huffman tab5 [16.le.62]
  40d52710 1774 mp3lib huffman tab6 [16.le.62]
  40d52750 1776 mp3lib huffman tab7 [16.le.142]
  40d527e0 1778 mp3lib huffman tab8 [16.le.142]
  40d52870 1780 mp3lib huffman tab9 [16.le.142]
  40d52900 1782 mp3lib huffman tab10 [16.le.254]
  40d52a00 1784 mp3lib huffman tab11 [16.le.254]
  40d52b00 1786 mp3lib huffman tab12 [16.le.254]
  40d52c00 1788 mp3lib huffman tab13 [16.le.1022]
  40d53000 1790 mp3lib huffman tab15 [16.le.1022]
  40d53400 1792 mp3lib huffman tab16 [16.le.1022]
  40d53800 1794 mp3lib huffman tab24 [16.le.1022]
  40d53c00 1796 mp3lib huffman tab_c0 [16.le.62]
  40d53c40 1798 mp3lib huffman tab_c1 [16.le.62]
  4182603e 1038 padding used in hashing algorithms (0x80 0 ... 0) [..64]
  418a38d4 1297 TEA encryption/decryption (0xc6ef3720  0x61c88647) [32.le.8&]

Any help would be much appreciated.