This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=1169

happyend, posted Sun Jul 12, 2015 2:56 pm (6339)

---

Samples:

http://www8.zippyshare.com/v/v5AXxkFw/file.html
http://www17.zippyshare.com/v/a2Y0ft5n/file.html

aluigi, posted Mon Jul 13, 2015 5:16 am (6342)

---

It looks encrypted or obfuscated.
This is the header:

Code:

idstring "evp"
get HASH string
get DUMMY short
get OFFSET longlong
get SIZE long
get DUMMY long
get DUMMY long
get ZERO long
get DUMMY long
get ZERO long
getdstring NAME 4

What's strange is that the data at offset 0x16072A3E looked like a header for compressed data but the fields don't match and there is no zlib/deflate data to scan.

happyend, posted Mon Jul 13, 2015 2:40 pm (6355)

---

script doesn't working...

aluigi, posted Mon Jul 13, 2015 6:16 pm (6362)

---

ah no, it's just a script to how the header information, it's not a real script for extracting the files.