7

The program I'm trying to decompile uses several supporting files:

  • somesound.mp3
  • someimage.jpg
  • etc..

The files are all located in the file system, not embedded into the exe. The files are used at runtime for the game images and sounds.

If I try and open one of the mp3s or jpgs directly windows will give me an error, the files are obviously packed/encrypted/obfuscated/compressed.

How can I determine the obfuscation type of the files?

I have determined that the first 4 bytes are the same in each file, 43 46 31 30 (CF10 in ASCII). Maybe this information would be useful.

7
  • 1
    If those bytes are added to the original files, that's already enough to make them unusable with regular software. Check what's directly after them; does that data look like a JPEG, MP3, etc.?
    – Jongware
    Oct 15, 2013 at 17:35
  • @Jongware No, there's no normal JPEG data after CF10. I found this question, it explains that CF10 means compression factor of 10 - stackoverflow.com/questions/113641/file-format-of-cf10-jpg
    – Drahcir
    Oct 15, 2013 at 17:51
  • What OS you are using?
    – nrz
    Oct 15, 2013 at 20:28
  • @nrz using windows 8
    – Drahcir
    Oct 15, 2013 at 21:18
  • 1
    Why don't you link a few example files or show us more than just the first four bytes. Somebody with a lot of experience with file formats might be able to spot the encoding.
    – Till
    Oct 16, 2013 at 16:02

2 Answers 2

7

You can give a try to binwalk. This tool is able to do a wild guess about the encryption/compression routine used, with the -BE option.

1

(After finally being able to examine 2 examples)

They are regular files, obfuscated with a simple XOR encoding. See https://stackoverflow.com/questions/26442162/decryption-of-png-and-jpg-files for a longer description.

The file extension may or may not be the original one.

1
  • Wow, thanks for the response, looks good! I will test tomorrow and see if it works for my files as well.
    – Drahcir
    Oct 18, 2014 at 18:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.