I am trying to decrypt a game for its assets for learning purposes. I have extracted out said assets from the game package, they are in formats of
.lua. However, they are encrypted. Inspecting the files in hex view, I noticed something particularly interesting: all of their bytes start with
4448 4741 4d45 53, which in ascii corresponds to the publisher of the game.
What I have done
stringscommand on the game binary to extract all the strings out, one of which should be the decryption key
Wrote a python script to try each of the possible keys on these encrypted assets using AES, XXTEA and XOR. The key is validated if the decryption result is a valid json/lua text file.
Usually these two steps alone would find me the key for many other games, but this time to no avail.
What other steps can I do to try to decrypt these assets statically without having to gdb into runtime?
** The link to assets can be found here https://www.dropbox.com/sh/7pqhvpsa0ems0q9/AAA8lHrudeix3hJ0Rz2tXPSxa?dl=0