Context
I am trying to decrypt a game for its assets for learning purposes. I have extracted out said assets from the game package, they are in formats of .json
, .png
and .lua
. However, they are encrypted. Inspecting the files in hex view, I noticed something particularly interesting: all of their bytes start with 4448 4741 4d45 53
, which in ascii corresponds to the publisher of the game.
What I have done
Ran a
strings
command on the game binary to extract all the strings out, one of which should be the decryption keyWrote a python script to try each of the possible keys on these encrypted assets using AES, XXTEA and XOR. The key is validated if the decryption result is a valid json/lua text file.
Usually these two steps alone would find me the key for many other games, but this time to no avail.
What other steps can I do to try to decrypt these assets statically without having to gdb into runtime?
** The link to assets can be found here https://www.dropbox.com/sh/7pqhvpsa0ems0q9/AAA8lHrudeix3hJ0Rz2tXPSxa?dl=0