How to find file compression or obfuscation type

Question

The program I'm trying to decompile uses several supporting files:

The files are all located in the file system, not embedded into the exe. The files are used at runtime for the game images and sounds.

If I try and open one of the mp3s or jpgs directly windows will give me an error, the files are obviously packed/encrypted/obfuscated/compressed.

How can I determine the obfuscation type of the files?

I have determined that the first 4 bytes are the same in each file, 43 46 31 30 (CF10 in ASCII). Maybe this information would be useful.

If those bytes are added to the original files, that's already enough to make them unusable with regular software. Check what's directly after them; does that data look like a JPEG, MP3, etc.? — Jongware, Oct 15, 2013 at 17:35
@Jongware No, there's no normal JPEG data after CF10. I found this question, it explains that CF10 means compression factor of 10 - stackoverflow.com/questions/113641/file-format-of-cf10-jpg — Drahcir, Oct 15, 2013 at 17:51
Why don't you link a few example files or show us more than just the first four bytes. Somebody with a lot of experience with file formats might be able to spot the encoding. — Till, Oct 16, 2013 at 16:02

0xC0000022L · Accepted Answer · 2013-11-28 15:20:20Z

7

You can give a try to binwalk. This tool is able to do a wild guess about the encryption/compression routine used, with the -BE option.

0xC0000022L♦

10.9k9 gold badges40 silver badges78 bronze badges

answered Oct 16, 2013 at 15:29

jvoisin

2,50616 silver badges23 bronze badges

Add a comment |

Community · Accepted Answer · 2017-05-23 12:37:19Z

1

(After finally being able to examine 2 examples)

They are regular files, obfuscated with a simple XOR encoding. See https://stackoverflow.com/questions/26442162/decryption-of-png-and-jpg-files for a longer description.

The file extension may or may not be the original one.

CommunityBot

1

answered Oct 18, 2014 at 18:25

Jongware

2,3542 gold badges16 silver badges30 bronze badges

Wow, thanks for the response, looks good! I will test tomorrow and see if it works for my files as well.
– Drahcir
Oct 18, 2014 at 18:48

Add a comment |

2 Answers 2