Decrypting Lua Files

Question

I am trying to decrypt a lua file which has been encrypting using a key. Some background to the LUA file. Its from an android Game i decompiled the APK and found that all the lua files are encrypted.

The Game is made in an engine called Coco2D which allows developers to encrypt their files using a key. After doing some research i found that you can use IDA to look into the Binaries of the SO File and Find the encryption key in a function called ApplicationDidFinishLaunching. I tried that but i'm not really sure what im looking for in that function.

IDA Text from ApplicationDidFinish Function: https://pastebin.com/9h69PADF

Near the top of the function you can see these set of variables

.text:00404100 var_90          = -0x90    
.text:00404100 var_84          = -0x84
.text:00404100 var_80          = -0x80
.text:00404100 var_7C          = -0x7C
.text:00404100 var_74          = -0x74
.text:00404100 var_70          = -0x70
.text:00404100 var_6C          = -0x6C
.text:00404100 var_68          = -0x68
.text:00404100 var_64          = -0x64
.text:00404100 var_60          = -0x60
.text:00404100 var_5C          = -0x5C
.text:00404100 var_3C          = -0x3C

Im not sure what the above variables represent but i dont think they represent the key since the key is meant to be 128bit string encoded as Hex.

Example of Encryption key: https://static.packt-cdn.com/products/9781783284757/graphics/B0561_11_01.jpg

After More Digging i found this section in the function https://pastebin.com/N44prr2N

This section includes 32 hex Digits with a break of DCB 5 and DCB 4 within. I think that this is most likely the key but im unsure on how i would assemble what i have in the pastebin to a 128Bit key. I also don't know what DCB is (goin g to do research on it in a sec) and i don't know why there are breaks of 5 and 4 within the section.

I went online and found a Hex to Ascii Converter and found that the hex digits do convert to Ascii. 7C converts to | and 78 converts to X just like the comments suggest but the problem i have now is that hex values such as 0xC dont convert to an Ascii value.

Link To the APK: https://apkpure.com/taptap-heroes/com.westbund.heros.en Link To Encrypted Lua File + SO: https://www.mediafire.com/file/5ypqt5tk0scjwb5/LuaEncrypted.rar/file

Edit: after looking at the pseudo for the function i found no sign of a XTEA key being used (i may be wrong). Although i did find that RSA endcoding was used for Lua files. I still don't know what or how to decode it if its using RSA.

Link To RSA: https://pastebin.com/quNJNzYd

Answer 1

xxtea encrypt with KEY: sxpDM2018

result FightLogic.lua

how find the KEY

• IDA look at Function window

• press CTRL+F and type xxtea_decrypt. double click first item and scroll up to see cocos2d::FileUtilsAndroid::getData

• double click cocos2d::FileUtilsAndroid::getData and press F5 to decompiler

• look at image xxtea_decrypt, you can see v34 is KEY scroll up and see, this is encrypt key

byte *xxtea_decrypt(byte *data, long data_len, byte *key, long key_len, long *ret_length)

• I rewrite code in javascript and run it with Chrome DevTool

var v45 = [896, 914, 915, 827, 756, 630, 499, 369, 252]
var v18 = 666
var v34 = []
for (var v17=0;v17<9;v17++) {
 v19 = v45[v17]
 v34.push((v19-v18)/2) //((((v19-v18)>>31) + (v19-v18)) << 23) >> 24
 v18 = (v19 - v17) - 222
}
// result sxpDM2018
console.log(String.fromCharCode.apply(null, v34))