1

I'm trying to decrypt LUA scripts from cocos2dx game (for wiki). In most cases, it's XXTEA based, but not in this case.

The game itself: https://apkpure.com/might-magic-era-of-chaos/com.ubisoft.might.magic.heroes.fantasy.rpg

I'm tried to use Frida. Works fine in Android emulator, not a problem to attach and check some methods calls with parameters.... but some methods are not detected, looks like protection hides them. Interesting, but all lua files are starting with "16c652b86b5b0bc516920e6cd3c3a074" (16 bites) prefix, but it's not a key for XXTEA algo.

2
  • What is your current progress on reversing the game?
    – morsisko
    Sep 17 '20 at 20:36
  • Hi morsisko, some part are funny... due bugly + android emulation frida is not able to attach to some methods... would be easy to get lua content via hooks in "lua_loadx", "luaL_loadfilex" and "luaL_loadbufferx". this game has another (looks like AES based) encription for files for cocos2d engine, correcly to say for resources (.lua and .png files). Sep 18 '20 at 7:44
1

use ida pro or ghidra to find the decryption function. if you attach to the process on a real phone you can hook the xxtea function and the 16 bytes at the 3rd argument pointer will be the key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.