3

Super Mario Run is a il2cpp Unity game. Most of its assets are downloaded in-game through http requests. I particularly want the OGG files of the music. I can see the list of their names comes from this file.

I know this because it appears before all the requests of the OGGs are made, sadly it and the OGGs are encrypted.

Since Super Mario Run is an il2cpp game, the strings and function names and whatnot are contained in a different file -- "global-metadata.dat". Looking at this file I can see a function named get_OggEncryptionAesKey, as for where this function is and what it returns I cannot find out.

I disassembled the "libil2cpp.so" with IDA, but did not seem to find this function or anything useful.

I believe that the libraries that deal with the encryption might be "libdeal.so" or "libDeALWrapper.so".

Closest I've came was pulling the ogg's from memory, but the best I got was some interface sounds.

Does anyone have any other ideas to decrypt these files?

  • 1
    If you obtain the encrypted files through http requests on runtime I can imagine the related decryption is also send somewhere during this process. Did you try to sniff the network requests/responses? – Jevgeni Geurtsen Oct 13 '17 at 9:21
  • I checked them all and didn't find anything that looked like an encryption key. – Michael Oct 14 '17 at 14:14
  • I believe libdeal is just a library for dealing with algorithms and complex data structures in C++ (not sure though). Atleast we know they use AES encryption. Maybe you can try to find the Rijndael algorithm and work from there? – Jevgeni Geurtsen Oct 14 '17 at 14:37
  • Also, have you looked at github.com/nevermoe/unity_metadata_loader ? – Jevgeni Geurtsen Oct 14 '17 at 14:42
  • @JevgeniGeurtsen I used that, but none of the files I've decompiled had the OggEncryptionAesKey function although they had all the other functions from the same class, very strange. – Michael Oct 14 '17 at 15:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.