I have this file here, that is supposed to be a wave audio file, but seems to have some obfuscation applied to it. The file header is here: https://pastebin.com/LD5aA1EG Any suggestions where else it would be appropriate to ask?
2 Answers
It looks like the file is xored by key 0xA7 0x23. After xoring the very first bytes, the header looks like this:
52 49 46 46 0C E1 16 13 57 41 56 45 66 6D 74 20 RIFF.á..WAVEfmt
So mostly like correct wave header.
-
thank you very much, unfortunately ever 512 bytes the cipher changes. Any ideas how to solve this? Here ist more of the file– TimCommented Jun 17, 2020 at 21:40
-
I don't see "more of the file". However how did you know this is music file? Do you have the program that can read the file? If so the best idea would be to RE the program.– morsiskoCommented Jun 17, 2020 at 22:04
-
its an embedded device, that mustn't be destroyed, so RE of the firmware is not an option. sorry it forget to paste the link pastebin.com/z8vEP30Y– TimCommented Jun 17, 2020 at 22:07
-
The file header once decoded shows that your wav file is over 320Mb. (the 4 bytes after "data")
The key changes every 512 bytes, so if they are set in advance you would need 625520 stored keys. This is of course very unlikely.
I think only the first key is frozen, the others can be just the XOR of the first 2 bytes of each group of 512 bytes.
To verify it would require a greater number of data, at least 1Mb, or better the complete zipped file.