I have a decryption formula, the file it links to containing file passwords, and the encrypted files themselves, but I still don't understand how to reverse the process.

Question: Do I need any more information to be able to decrypt the files (if so, what?) + if I am able to decrypt the files, what is the best way to do so?

The steps in the formula are (from the comments in the code):

1. Assess whether the file is a sound file

if [ ${FILE##*.} != mp3 ] && [${FILE##*.} != wav ] && [ ${FILE##*.} != mov ] ; then  2. XOR non-sound files with passwords based on a separate file (.out) echo "encrypt${FILE}"
mv "$FILE" "${FILE}_"
../tools/pass.out "${FILE}_" "$FILE"
rm "${FILE}_"  3. Change the file name to a hash value or just change the file extension MP3_FILENAME=basename${FILE}
DIR_NAME=${FILE%/*.*}/ if [${DIR_NAME} != ./tmp/cc/ ] && [ ${DIR_NAME} != ./tmp/dd/ ] ; then SHA1=get_random_mp3_filename${MP3_FILENAME}
mv "${FILE}" "${DIR_NAME}${SHA1#SHA1(${FILE})= }.png"
echo "${MP3_FILENAME}:${SHA1}"
else
mv "${FILE}" "${FILE%.*}.png"


The pass.out file (CF FA ED FE) disassembles without issue. I have no idea how it works or how to use it in reverse. I have attached the file below.

pass.out

Apologies in advance if I've made any wrong assumptions or used wrong terminology. Any help, explanations, or pointers to learning resources would be much appreciated!

EDIT: Sorry for the confusion! The files are from the .apk of an Android app. My aim is to decrypt them to common file formats e.g. .png and .mp3. From inspecting the .apk, I believe files are processed in the following ways: 1) Sound files (.wav, .mp3, .mov) in specific folders have their extension changed to .png. I can play them by changing the extension back to the original. 2) All other files are XOR encrypted by running them through the pass.out file. I want to know how to reverse this process.

• this is a pretty confusing question. Maybe you should explain from the beginning what happened, how/where did you get all those files and what you want to achieve – Igor Skochinsky Sep 29 '17 at 14:24