2

I am trying to decrypt a lua file which has been encrypting using a key. Some background to the LUA file. Its from an android Game i decompiled the APK and found that all the lua files are encrypted.

The Game is made in an engine called Coco2D which allows developers to encrypt their files using a key. After doing some research i found that you can use IDA to look into the Binaries of the SO File and Find the encryption key in a function called ApplicationDidFinishLaunching. I tried that but i'm not really sure what im looking for in that function.

IDA Text from ApplicationDidFinish Function: https://pastebin.com/9h69PADF

Near the top of the function you can see these set of variables

.text:00404100 var_90          = -0x90    
.text:00404100 var_84          = -0x84
.text:00404100 var_80          = -0x80
.text:00404100 var_7C          = -0x7C
.text:00404100 var_74          = -0x74
.text:00404100 var_70          = -0x70
.text:00404100 var_6C          = -0x6C
.text:00404100 var_68          = -0x68
.text:00404100 var_64          = -0x64
.text:00404100 var_60          = -0x60
.text:00404100 var_5C          = -0x5C
.text:00404100 var_3C          = -0x3C

Im not sure what the above variables represent but i dont think they represent the key since the key is meant to be 128bit string encoded as Hex.

Example of Encryption key: https://static.packt-cdn.com/products/9781783284757/graphics/B0561_11_01.jpg

After More Digging i found this section in the function https://pastebin.com/N44prr2N

This section includes 32 hex Digits with a break of DCB 5 and DCB 4 within. I think that this is most likely the key but im unsure on how i would assemble what i have in the pastebin to a 128Bit key. I also don't know what DCB is (goin g to do research on it in a sec) and i don't know why there are breaks of 5 and 4 within the section.

I went online and found a Hex to Ascii Converter and found that the hex digits do convert to Ascii. 7C converts to | and 78 converts to X just like the comments suggest but the problem i have now is that hex values such as 0xC dont convert to an Ascii value.

Link To the APK: https://apkpure.com/taptap-heroes/com.westbund.heros.en Link To Encrypted Lua File + SO: https://www.mediafire.com/file/5ypqt5tk0scjwb5/LuaEncrypted.rar/file

Edit: after looking at the pseudo for the function i found no sign of a XTEA key being used (i may be wrong). Although i did find that RSA endcoding was used for Lua files. I still don't know what or how to decode it if its using RSA.

Link To RSA: https://pastebin.com/quNJNzYd

  • The var_XX = XX lines you're seeing are var offsets, not values. I highly recommend that you look for some IDA Pro tutorials and introductory videos. – tmr232 Jul 24 '19 at 17:42
6

xxtea encrypt with KEY: sxpDM2018

result FightLogic.lua

how find the KEY

  • IDA look at Function window
  • press CTRL+F and type xxtea_decrypt. double click first item and scroll up to see cocos2d::FileUtilsAndroid::getData result

  • double click cocos2d::FileUtilsAndroid::getData and press F5 to decompiler result

  • look at image xxtea_decrypt, you can see v34 is KEY scroll up and see, this is encrypt key

byte *xxtea_decrypt(byte *data, long data_len, byte *key, long key_len, long *ret_length)

result

  • I rewrite code in javascript and run it with Chrome DevTool
var v45 = [896, 914, 915, 827, 756, 630, 499, 369, 252]
var v18 = 666
var v34 = []
for (var v17=0;v17<9;v17++) {
 v19 = v45[v17]
 v34.push((v19-v18)/2) //((((v19-v18)>>31) + (v19-v18)) << 23) >> 24
 v18 = (v19 - v17) - 222
}
// result sxpDM2018
console.log(String.fromCharCode.apply(null, v34))

final

| improve this answer | |
  • 1
    Hi and welcome to RE.SE. It's said: Give a man a fish, and you feed him for a day; show him how to catch fish, and you feed him for a lifetime. ... perhaps you'd like to elaborate how you got there (tools, approach ...) instead of simply doing the homework?! Thanks. – 0xC0000022L Jul 25 '19 at 12:21
  • thank you is it possible to know how you achieved this as i don't want to come back everytime the key changes + it would be great to know thanks alot anyways ive been looking at it for the past few days and as someone new to reverse engineering this is all too confusing – Dan Jul 25 '19 at 13:52
  • 1
    ok, i will edit tomorrow. – user29082 Jul 25 '19 at 14:20
  • okay thanks by any chance when you edit it tomorrow can you tell me how you decrypted the file because i used a simple python script to decrypt the same file in but it didn't work – Dan Jul 25 '19 at 14:21
  • You need to remove 8byte sign imgur.com/YZ8mg17 – user29082 Jul 25 '19 at 14:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.