This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=11476

thethiny, posted Fri May 17, 2019 3:39 am (47795)

---

I have this file that I believe that it's XORed with a key length of 8. The file has a footer. The file I'm trying to crack is endpoints.json. I attached other files too because it might help to check the similarities. I've noticed the string "gikmoqsu", which I thought maybe it was a 00 padding that was XORed with that key in that place. But it didn't work unfortunately. Any help would be appreciated!

thethiny, posted Sat May 25, 2019 12:36 pm (48013)

---

Can someone help me try to figure out how to unpack this archive? I'm sure that it is XORed and Compressed. They all end with the string mcnxyxcmvmcxyxcmskdldkjshagsdhfj. I believe the XOR key might be 0x01 0x03 0x05 0x07 0x09 0x0B ...etc

Here are the files
https://ufile.io/dz0qx9k4

Thanks.

aluigi, posted Sat Jun 01, 2019 11:42 pm (48293)

---

Coalesced files are all encrypted, often with aes but in my experience they may use other algorithms too.
Better if you can upload the game executable in case someone wants to check.

thethiny, posted Sun Jun 02, 2019 1:49 am (48328)

---

aluigi wrote:

Coalesced files are all encrypted, often with aes but in my experience they may use other algorithms too.
Better if you can upload the game executable in case someone wants to check.

Thank you for your reply aluigi, the executable is large (400MB), it'll take time to upload. Will do in due time.
They're XOR, AES, and oodle covered.

edit: her's a pic that might help (x64dbg)
https://i.imgur.com/ursA6im.png

edit: exe and all encrypted files
https://mega.nz/#F!OqxkiCZK!7sO-atNWSPPFqNABUl4RiQ