2

I am trying to decrypt a lua file which has been encrypting using a key. Some background to the LUA file. Its from an android Game i decompiled the APK and found that all the lua files are encrypted.

The Game is made in an engine called Coco2D which allows developers to encrypt their files using a key. After doing some research i found that you can use IDA to look into the Binaries of the SO File and Find the encryption key in a function called ApplicationDidFinishLaunching. I tried that but i'm not really sure what im looking for in that function.

IDA Text from ApplicationDidFinish Function: https://pastebin.com/9h69PADF

Near the top of the function you can see these set of variables

.text:00404100 var_90          = -0x90    
.text:00404100 var_84          = -0x84
.text:00404100 var_80          = -0x80
.text:00404100 var_7C          = -0x7C
.text:00404100 var_74          = -0x74
.text:00404100 var_70          = -0x70
.text:00404100 var_6C          = -0x6C
.text:00404100 var_68          = -0x68
.text:00404100 var_64          = -0x64
.text:00404100 var_60          = -0x60
.text:00404100 var_5C          = -0x5C
.text:00404100 var_3C          = -0x3C

Im not sure what the above variables represent but i dont think they represent the key since the key is meant to be 128bit string encoded as Hex.

Example of Encryption key: https://static.packt-cdn.com/products/9781783284757/graphics/B0561_11_01.jpg

After More Digging i found this section in the function https://pastebin.com/N44prr2N

This section includes 32 hex Digits with a break of DCB 5 and DCB 4 within. I think that this is most likely the key but im unsure on how i would assemble what i have in the pastebin to a 128Bit key. I also don't know what DCB is (goin g to do research on it in a sec) and i don't know why there are breaks of 5 and 4 within the section.

I went online and found a Hex to Ascii Converter and found that the hex digits do convert to Ascii. 7C converts to | and 78 converts to X just like the comments suggest but the problem i have now is that hex values such as 0xC dont convert to an Ascii value.

Link To the APK: https://apkpure.com/taptap-heroes/com.westbund.heros.en Link To Encrypted Lua File + SO: https://www.mediafire.com/file/5ypqt5tk0scjwb5/LuaEncrypted.rar/file

Edit: after looking at the pseudo for the function i found no sign of a XTEA key being used (i may be wrong). Although i did find that RSA endcoding was used for Lua files. I still don't know what or how to decode it if its using RSA.

Link To RSA: https://pastebin.com/quNJNzYd

  • The var_XX = XX lines you're seeing are var offsets, not values. I highly recommend that you look for some IDA Pro tutorials and introductory videos. – tmr232 Jul 24 at 17:42
3

xxtea encrypt with KEY: sxpDM2018

result FightLogic.lua

how find the KEY

  • IDA look at Function window
  • press CTRL+F and type xxtea_decrypt. double click first item and scroll up to see cocos2d::FileUtilsAndroid::getData result

  • double click cocos2d::FileUtilsAndroid::getData and press F5 to decompiler result

  • look at image xxtea_decrypt, you can see v34 is KEY scroll up and see, this is encrypt key

byte *xxtea_decrypt(byte *data, long data_len, byte *key, long key_len, long *ret_length)

result

  • I rewrite code in javascript and run it with Chrome DevTool
var v45 = [896, 914, 915, 827, 756, 630, 499, 369, 252]
var v18 = 666
var v34 = []
for (var v17=0;v17<9;v17++) {
 v19 = v45[v17]
 v34.push((v19-v18)/2) //((((v19-v18)>>31) + (v19-v18)) << 23) >> 24
 v18 = (v19 - v17) - 222
}
// result sxpDM2018
console.log(String.fromCharCode.apply(null, v34))

final

  • 1
    Hi and welcome to RE.SE. It's said: Give a man a fish, and you feed him for a day; show him how to catch fish, and you feed him for a lifetime. ... perhaps you'd like to elaborate how you got there (tools, approach ...) instead of simply doing the homework?! Thanks. – 0xC0000022L Jul 25 at 12:21
  • thank you is it possible to know how you achieved this as i don't want to come back everytime the key changes + it would be great to know thanks alot anyways ive been looking at it for the past few days and as someone new to reverse engineering this is all too confusing – Dan Jul 25 at 13:52
  • 1
    ok, i will edit tomorrow. – user29082 Jul 25 at 14:20
  • okay thanks by any chance when you edit it tomorrow can you tell me how you decrypted the file because i used a simple python script to decrypt the same file in but it didn't work – Dan Jul 25 at 14:21
  • You need to remove 8byte sign imgur.com/YZ8mg17 – user29082 Jul 25 at 14:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.