Super Mario Run is a il2cpp Unity game. Most of its assets are downloaded in-game through http requests. I particularly want the OGG files of the music. I can see the list of their names comes from this file.
I know this because it appears before all the requests of the OGGs are made, sadly it and the OGGs are encrypted.
Since Super Mario Run is an il2cpp game, the strings and function names and whatnot are contained in a different file -- "global-metadata.dat". Looking at this file I can see a function named
get_OggEncryptionAesKey, as for where this function is and what it returns I cannot find out.
I disassembled the "libil2cpp.so" with IDA, but did not seem to find this function or anything useful.
I believe that the libraries that deal with the encryption might be "libdeal.so" or "libDeALWrapper.so".
Closest I've came was pulling the ogg's from memory, but the best I got was some interface sounds.
Does anyone have any other ideas to decrypt these files?