Find out string encoding/shift of proprietary binary file format

Question

I'm trying to reverse-engineer a proprietary file format to be able to extract certain strings from files in this format. I have the application, that writes the files, at hand.

By trial-and-error I found out a few characters, however I'm currently clueless what kind of encoding this is or if there exists some kind of shift to obfuscate things.

The alphabet I found out by saving strings with the proprietary application looks like this:

0x3B: 'a'
0x38: 'b'
0x39: 'c'
0x3E: 'd'
0x3F: 'e'
0x3C: 'f'
0x3D: 'g'
0x32: 'h'
0x33: 'i'
0x30: 'j'
0x31: 'k'
0x36: 'l'
0x37: 'm'
0x34: 'n'
0x35: 'o'
0x2A: 'p'
0x2B: 'q'
0x28: 'r'
0x29: 's'
0x2E: 't'
0x2F: 'u'
0x2C: 'v'
0x2D: 'w'
0x22: 'x'
0x23: 'y'
0x20: 'z'

I tried looking at the shift from the Unicode codepoints. Going from a onwards you get a shift of 38, 42, 42, 38, 38, 42, 42, 54, 54, 58, 58, 54, 54, etc.

Do you see any pattern? Any idea on how to proceed except continuing to complete all characters by manual trial-and-error? Would really like to get some basic hints / other things I could try as this is the first time I am doing this.

Answer 1

It's a simple exclusive-or (^) operation with the byte 0x5A.

With your examples -

'a' 0x61 ^ 0x5A = 0x3B
'b' 0x62 ^ 0x5A = 0x38
'z' 0x7A ^ 0x5A = 0x20

Plus some others you should be able to check -

'!' 0x21 ^ 0x5A = 0x7B
'4' 0x34 ^ 0x5A = 0x6E
'Q' 0x51 ^ 0x5A = 0x0B
']' 0x5D ^ 0x5A = 0x07