How to decode lua files and resource files that are protected from Frida and IDA64?

Question

I am trying to decrypt Lua files from an Android game "The Sea Road: Fate Assembly" (APK download link). It uses Cocos2d-x, but it's encrypted, maybe with AES encryption.

With Frida, the game will crash when I hook it. It also crashes in IDA64 when I hook it. Have someone an idea and when I search for the sig: GuoSig, I can't find it.

Answer 1

As with other cocos2dx games there's a function called xxtea_decrypt which you can see being called via IDA, Ghidra, etc; - the third parameter is the key, s:

Going to unk_117E730:

The key is as follows (I was able to decrypt the first file I tried):

09 08 07 AB 01 02 03 AB 04 05 06 AA BB CC AB AC