I am trying to decrypt a lua file which has been encrypting using a key. Some background to the LUA file. Its from an android Game i decompiled the APK and found that all the lua files are encrypted.
The Game is made in an engine called Coco2D which allows developers to encrypt their files using a key. After doing some research i found that you can use IDA to look into the Binaries of the SO File and Find the encryption key in a function called ApplicationDidFinishLaunching. I tried that but i'm not really sure what im looking for in that function.
IDA Text from ApplicationDidFinish Function: https://pastebin.com/9h69PADF
Near the top of the function you can see these set of variables
.text:00404100 var_90 = -0x90 .text:00404100 var_84 = -0x84 .text:00404100 var_80 = -0x80 .text:00404100 var_7C = -0x7C .text:00404100 var_74 = -0x74 .text:00404100 var_70 = -0x70 .text:00404100 var_6C = -0x6C .text:00404100 var_68 = -0x68 .text:00404100 var_64 = -0x64 .text:00404100 var_60 = -0x60 .text:00404100 var_5C = -0x5C .text:00404100 var_3C = -0x3C
Im not sure what the above variables represent but i dont think they represent the key since the key is meant to be 128bit string encoded as Hex.
Example of Encryption key: https://static.packt-cdn.com/products/9781783284757/graphics/B0561_11_01.jpg
After More Digging i found this section in the function https://pastebin.com/N44prr2N
This section includes 32 hex Digits with a break of DCB 5 and DCB 4 within. I think that this is most likely the key but im unsure on how i would assemble what i have in the pastebin to a 128Bit key. I also don't know what DCB is (goin g to do research on it in a sec) and i don't know why there are breaks of 5 and 4 within the section.
I went online and found a Hex to Ascii Converter and found that the hex digits do convert to Ascii. 7C converts to | and 78 converts to X just like the comments suggest but the problem i have now is that hex values such as 0xC dont convert to an Ascii value.
Link To the APK: https://apkpure.com/taptap-heroes/com.westbund.heros.en Link To Encrypted Lua File + SO: https://www.mediafire.com/file/5ypqt5tk0scjwb5/LuaEncrypted.rar/file
Edit: after looking at the pseudo for the function i found no sign of a XTEA key being used (i may be wrong). Although i did find that RSA endcoding was used for Lua files. I still don't know what or how to decode it if its using RSA.
Link To RSA: https://pastebin.com/quNJNzYd