I've a binary data files which are encrypted by a simple XOR cipher using a given key at offset +0x88 (which is 0x80 long), then the data (+0x108) is compressed by lzo1x.

What would be the most efficient way of decrypting such files?

Preferably by using some command-line utilities (where I can specify the input offsets) or some script (without too much coding)?

What would be the right approach?

  • 2
    The right approach is writing script in a language of your choice. I'd do it in Python. – w s Oct 6 '15 at 6:07
  • 1
    As @ws suggested, you should just take your favorite language and make a tool for that... In fact, I don't see the point of this question. Am I missing something ? – perror Oct 6 '15 at 7:04
  • No there isn't. – w s Oct 6 '15 at 8:33
  • @perror The point is to have useful Q&A about simple XOR deciphering (which seems there is a lack in here) and to share the knowledge. I don't see the reason why criticise the question by people who doesn't know the answer. – kenorb Oct 6 '15 at 9:43
  • @ws Now there is one. – kenorb Oct 6 '15 at 9:44

Use dd to extract the data what you need, e.g. (using bash syntax):

dd if=foo.dat bs=1 skip=$((0x88)) count=$((0x80)) of=xorkey.bin
dd if=foo.dat bs=1 skip=$((0x108)) of=data1.bin

Then convert it using simple Python code:

#!/usr/bin/env python3

def str_xor(data, key):
    for i in range(len(data)):
        data[i] ^= key[i % len(key)]
    return data

key  = bytearray(open('xorkey.bin', 'rb').read())
data = bytearray(open('data1.bin',  'rb').read())
encoded = str_xor(data, key)
open("data1.bin.xor", "wb").write(encoded)
decoded = str_xor(data, key)
open("data1.bin.xor.xor", "wb").write(decoded)

Then install lzop tool which offers compression/decompression of the LZO1X algorithms (install via: apt-get/brew install lzop), e.g.:

lzop -dc data1.bin.xor > data1.out
| improve this answer | |
  • you could use powershell to get the bytes from a specific block of file and use it foreach operator to xor the bytes like this $foo=(($c=gc .\encrypted.dat -Encoding byte)[0x80..$C.Length]) |%{$_ -bxor 63} – blabb Oct 6 '15 at 21:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.