6

The program I'm trying to decompile uses several supporting files:

  • somesound.mp3
  • someimage.jpg
  • etc..

The files are all located in the file system, not embedded into the exe. The files are used at runtime for the game images and sounds.

If I try and open one of the mp3s or jpgs directly windows will give me an error, the files are obviously packed/encrypted/obfuscated/compressed.

How can I determine the obfuscation type of the files?

I have determined that the first 4 bytes are the same in each file, 43 46 31 30 (CF10 in ASCII). Maybe this information would be useful.

  • 1
    If those bytes are added to the original files, that's already enough to make them unusable with regular software. Check what's directly after them; does that data look like a JPEG, MP3, etc.? – usr2564301 Oct 15 '13 at 17:35
  • @Jongware No, there's no normal JPEG data after CF10. I found this question, it explains that CF10 means compression factor of 10 - stackoverflow.com/questions/113641/file-format-of-cf10-jpg – Drahcir Oct 15 '13 at 17:51
  • What OS you are using? – nrz Oct 15 '13 at 20:28
  • @nrz using windows 8 – Drahcir Oct 15 '13 at 21:18
  • 1
    Why don't you link a few example files or show us more than just the first four bytes. Somebody with a lot of experience with file formats might be able to spot the encoding. – Till Oct 16 '13 at 16:02
7

You can give a try to binwalk. This tool is able to do a wild guess about the encryption/compression routine used, with the -BE option.

1

(After finally being able to examine 2 examples)

They are regular files, obfuscated with a simple XOR encoding. See https://stackoverflow.com/questions/26442162/decryption-of-png-and-jpg-files for a longer description.

The file extension may or may not be the original one.

  • Wow, thanks for the response, looks good! I will test tomorrow and see if it works for my files as well. – Drahcir Oct 18 '14 at 18:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.