# How to decrypt data in binary file by XOR operator using a given key at specific offset? [closed]

I've a binary data files which are encrypted by a simple XOR cipher using a given key at offset `+0x88` (which is `0x80` long), then the data (`+0x108`) is compressed by `lzo1x`.

What would be the most efficient way of decrypting such files?

Preferably by using some command-line utilities (where I can specify the input offsets) or some script (without too much coding)?

What would be the right approach?

• The right approach is writing script in a language of your choice. I'd do it in Python. – w s Oct 6 '15 at 6:07
• As @ws suggested, you should just take your favorite language and make a tool for that... In fact, I don't see the point of this question. Am I missing something ? – perror Oct 6 '15 at 7:04
• No there isn't. – w s Oct 6 '15 at 8:33
• @perror The point is to have useful Q&A about simple XOR deciphering (which seems there is a lack in here) and to share the knowledge. I don't see the reason why criticise the question by people who doesn't know the answer. – kenorb Oct 6 '15 at 9:43
• @ws Now there is one. – kenorb Oct 6 '15 at 9:44

## 1 Answer

Use `dd` to extract the data what you need, e.g. (using bash syntax):

``````dd if=foo.dat bs=1 skip=\$((0x88)) count=\$((0x80)) of=xorkey.bin
dd if=foo.dat bs=1 skip=\$((0x108)) of=data1.bin
``````

Then convert it using simple Python code:

``````#!/usr/bin/env python3

def str_xor(data, key):
for i in range(len(data)):
data[i] ^= key[i % len(key)]
return data

key  = bytearray(open('xorkey.bin', 'rb').read())
data = bytearray(open('data1.bin',  'rb').read())
encoded = str_xor(data, key)
open("data1.bin.xor", "wb").write(encoded)
decoded = str_xor(data, key)
open("data1.bin.xor.xor", "wb").write(decoded)
``````

Then install `lzop` tool which offers compression/decompression of the LZO1X algorithms (install via: `apt-get`/`brew` `install lzop`), e.g.:

``````lzop -dc data1.bin.xor > data1.out
``````
• you could use powershell to get the bytes from a specific block of file and use it foreach operator to xor the bytes like this \$foo=((\$c=gc .\encrypted.dat -Encoding byte)[0x80..\$C.Length]) |%{\$_ -bxor 63} – blabb Oct 6 '15 at 21:33
• Instead of writing your own python code, you can use `xortool-xor` from github.com/hellman/xortool – cweiske Nov 1 '20 at 10:51