I have a game plugin that enables the lua script encryption.I tried to decode it but it seems used many useless encode method to let you cannot understand it.It seem like some enctypted lua script there,But they are something different.(Decrypting Lua Files)
The main file is win.xpl,a dll file.And i decode it with IDA and it seems to read the init .secured file first,and read main.key and serial.key(they all encrypted) And it read acturl.dat to get activation link.Sadly,they all encrypted.All encrypted lua script is .secured and it's unreadable.
Some can tell me what encryption is used?Thanks!
Main program file:https://drive.google.com/open?id=1tUMcOPEFA0alc0lSHvT3YCKvR2llclJ2
And i found a vaild main.key file:https://drive.google.com/open?id=11unjtWBKqrbhlKKDXA6G3lmWemFaFbDx
And the init main file:https://drive.google.com/open?id=1OSpgGsiJsqe7H3YO1dXYBQFlaozXNDTB
Here maybe the acvation part:
v45 = -2i64;
v2 = a2;
v3 = a1;
XPLMGetVersions(&v42, &v44, &v43);
v81 = 15i64;
v80 = 0i64;
Dst = 0;
v4 = "10";
if ( v42 >= 11000 )
v4 = "11";
sub_1800845F0(&Dst, v4, 2ui64);
v5 = sub_1800978F0();
v6 = sub_180097E40(v5, &v46);
sub_18008AD20((__int64)&Filename, v6, "/main.key");
if ( v48 >= 0x10 )
{
v7 = (void *)v46;
if ( v48 + 1 >= 0x1000 )
{
if ( v46 & 0x1F )
invalid_parameter_noinfo_noreturn();
v8 = *(_QWORD *)(v46 - 8);
if ( v8 >= v46 )
invalid_parameter_noinfo_noreturn();
if ( v46 - v8 < 8 )
invalid_parameter_noinfo_noreturn();
if ( v46 - v8 > 0x27 )
invalid_parameter_noinfo_noreturn();
v7 = *(void **)(v46 - 8);
}
j_j__free_base(v7);
}
I think the key is in the "v6"?
