I have this file here, that is supposed to be a wave audio file, but seems to have some obfuscation applied to it. The file header is here: https://pastebin.com/LD5aA1EG Any suggestions where else it would be appropriate to ask?

2 Answers 2


It looks like the file is xored by key 0xA7 0x23. After xoring the very first bytes, the header looks like this:

52 49 46 46 0C E1 16 13 57 41 56 45 66 6D 74 20 RIFF.á..WAVEfmt

So mostly like correct wave header.

  • thank you very much, unfortunately ever 512 bytes the cipher changes. Any ideas how to solve this? Here ist more of the file
    – Tim
    Jun 17, 2020 at 21:40
  • I don't see "more of the file". However how did you know this is music file? Do you have the program that can read the file? If so the best idea would be to RE the program.
    – morsisko
    Jun 17, 2020 at 22:04
  • its an embedded device, that mustn't be destroyed, so RE of the firmware is not an option. sorry it forget to paste the link pastebin.com/z8vEP30Y
    – Tim
    Jun 17, 2020 at 22:07
  • does the manufacturer publish firmware updates ?
    – Ian Cook
    Jul 19, 2020 at 9:04

The file header once decoded shows that your wav file is over 320Mb. (the 4 bytes after "data")
The key changes every 512 bytes, so if they are set in advance you would need 625520 stored keys. This is of course very unlikely.
I think only the first key is frozen, the others can be just the XOR of the first 2 bytes of each group of 512 bytes.
To verify it would require a greater number of data, at least 1Mb, or better the complete zipped file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.