Decrypting assets (json/png/lua)

Question

Context

I am trying to decrypt a game for its assets for learning purposes. I have extracted out said assets from the game package, they are in formats of .json, .png and .lua. However, they are encrypted. Inspecting the files in hex view, I noticed something particularly interesting: all of their bytes start with 4448 4741 4d45 53, which in ascii corresponds to the publisher of the game.

What I have done

1. Ran a strings command on the game binary to extract all the strings out, one of which should be the decryption key

2. Wrote a python script to try each of the possible keys on these encrypted assets using AES, XXTEA and XOR. The key is validated if the decryption result is a valid json/lua text file.

Usually these two steps alone would find me the key for many other games, but this time to no avail.

What other steps can I do to try to decrypt these assets statically without having to gdb into runtime?

** The link to assets can be found here https://www.dropbox.com/sh/7pqhvpsa0ems0q9/AAA8lHrudeix3hJ0Rz2tXPSxa?dl=0

Answer 1

There are a few things you can still try, like running signsrch over the binary to see if it has any encryption algorithm signatures.

Also, gzipping these files increases their size:

gbl@roran:~/Temp/14102$ ls -l
-rw-r--r-- 1 gbl users 1319 Dez  3 20:40 effect.json
-rw-r--r-- 1 gbl users  119 Dez  3 20:40 version.lua
gbl@roran:~/Temp/14102$ gzip *
gbl@roran:~/Temp/14102$ ls -l
-rw-r--r-- 1 gbl users 1354 Dez  3 20:40 effect.json.gz
-rw-r--r-- 1 gbl users  154 Dez  3 20:40 version.lua.gz

which might be a hint they're compressed as well -- but maybe not, as encrypting them should increase their entropy just the same, which would result in the same effect.

Anyway, check if the result of your decryption step has a compressor signature, and decompress if it has.

But honestly, disassembling the code, checking for the 4448 4741 4d45 53 string, where it is referenced, and starting your reversing there, is probably the only way to do this. Remember the encryption key might be any binary byte sequence as well, or even generated on runtime, so you can't really assume to find it using strings.