Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
Following string looks like base64 to me, but fewer digits or lowercase characters than upper. Some base64 decoders fail decoding it. Could it still be base64? Is there a way to decode it?
XkNGFUACH01FRUUXXV5WVFMEFkxVXA4dB0EVWkxBBxFTQ20VUktDFV1AVhYDCwYEAFFQTQYEVFRXDANQUQJWUw4FBFBVCwlaCgoFDAIEVAEDVV
This might be base64, Although it is missing the required padding. base64 encoded string lengths are 4*(n/3) where n is the original string. Padding is done with one or two equal (=) marks. Since your string is 110 bytes long, it should end with two padding bytes.
Manually adding the two padding bytes (which are sometimes omitted because they're predictable) results in the following hex:
5e43461540021f4d454545175d5e56545304164c555c0e1d0741155a4c41071153436d15524b43155d405616030b06040051504d06045454570c0350510256530e050450550b095a0a0a050c020454010355
Does this look right to you?
Because more than half the characters in this binary string are relatively low numbers and uppercase letters are at the bottom of the base64 table, it's reasonable to have an encoded string with many uppercase letters.
This is merely a guess, and must be validated by comparing multiple known input/output pairs or by actually reverse engineering the encoding/decoding function.
