Since few days, Ive started to Reverse Engineer a little game. That game includes some data files, where the 3d files are stored. I want to write a little Software, where I can add own 3d models, to improve (cutomize) that game.
Luckily the game is compiled in debug mode, so I can clearly see all method names, c++ classes, etc., so I clearly know what happens in particular places in the code. Since I am new on reverse engineering (but not new in development), Ive figured out a lot of the code base and reimplemented many things related to the "Data management of the game".
I see, in the disassembled code, there is a class which decrypts a file. Two methods are used. Initializing the decryptor and reading a character. Since I am not good at "reverse engineering" and crypto algorithms (I don´t even know whether the used crypto is a know algorithm or an own one), I hoped you guys could help me out to figure out what happens exactly on those methods, so I can re implement that in c++.
I am going to include the asm sections and the pseudo c code (which my decompiler has produced). Notice that these methods are part of a class. So I will give you some additional information of what Ive figured out so far. I hope you guys could help me.
Decryptor init method: (edi + 0x100 + offset) seems to be a char array of size 128 byte, but I couldn´t figure out the rest (It seems to be worked with char array, but like mentioned, I dont have that much experience with RE)
ASM Code: http://pastebin.com/LiM10Cr5
Pseudo-C: http://pastebin.com/1ewfxAh1
Decryptor decrypt next char method:
(edi + 0x200) seems to be a char (byte) where the next char or something similar is stored.
ASM Code: https://pastebin.com/aWp8LYua
Pseudo-C: https://pastebin.com/u4w5yGYS
If you need some more information, like mentioned, the application is fully compiled in debug mode, so its like a dream... I have all labels, all vtables, all information...
I also have a read method, where these both methods are gonna called, but I guess I have reverse engineered that method properly (I hope so)...
Thanks :)