I have a game plugin that enables the lua script encryption.I tried to decode it but it seems used many useless encode method to let you cannot understand it.It seem like some enctypted lua script there,But they are something different.(Decrypting Lua Files)

The main file is win.xpl,a dll file.And i decode it with IDA and it seems to read the init .secured file first,and read main.key and serial.key(they all encrypted) And it read acturl.dat to get activation link.Sadly,they all encrypted.All encrypted lua script is .secured and it's unreadable.

Some can tell me what encryption is used?Thanks!

Main program file:https://drive.google.com/open?id=1tUMcOPEFA0alc0lSHvT3YCKvR2llclJ2

And i found a vaild main.key file:https://drive.google.com/open?id=11unjtWBKqrbhlKKDXA6G3lmWemFaFbDx

And the init main file:https://drive.google.com/open?id=1OSpgGsiJsqe7H3YO1dXYBQFlaozXNDTB

Here maybe the acvation part:

v45 = -2i64; v2 = a2; v3 = a1; XPLMGetVersions(&v42, &v44, &v43); v81 = 15i64; v80 = 0i64; Dst = 0; v4 = "10"; if ( v42 >= 11000 ) v4 = "11"; sub_1800845F0(&Dst, v4, 2ui64); v5 = sub_1800978F0(); v6 = sub_180097E40(v5, &v46); sub_18008AD20((__int64)&Filename, v6, "/main.key"); if ( v48 >= 0x10 ) { v7 = (void *)v46; if ( v48 + 1 >= 0x1000 ) { if ( v46 & 0x1F ) invalid_parameter_noinfo_noreturn(); v8 = *(_QWORD *)(v46 - 8); if ( v8 >= v46 ) invalid_parameter_noinfo_noreturn(); if ( v46 - v8 < 8 ) invalid_parameter_noinfo_noreturn(); if ( v46 - v8 > 0x27 ) invalid_parameter_noinfo_noreturn(); v7 = *(void **)(v46 - 8); } j_j__free_base(v7); }

I think the key is in the "v6"?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.