1

I'm busy trying to decrypt some game data. All the encrypted filenames are hexadecimal strings with the same length e.g. 1790C6E445C7E38EFCD5B3042F9B4443.

I've figured out that a few of the files are unencrypted OGG files, and I've used the strings command to find a list of the .ogg strings contained within the game binary.

Now I'm wondering, is there any way to find out how the file name was created, given the original?

And would it be possible to recreate the directory structure somehow (right now it's all flat, but according to the strings I've found, there should be directories).

3
  • What makes you think the file names are encrypted? The fact that they're all of the same length suggests that they're in fact not encrypted. Aug 3, 2015 at 20:02
  • @JasonGeffner: I guess encrypted was the wrong word? (I have very limited experience in this area). Maybe obfuscated is the correct term? Can I ask why the fact that they're all the same length suggests they're not encrypted?
    – Tspoon
    Aug 3, 2015 at 20:10
  • 1
    There's typically (though not always) a correlation between plaintext length and ciphertext length. It's unlikely that each plaintext file name was of the same length, and given that each ciphertext is of the same length, it suggests that this probably isn't encryption. Aug 3, 2015 at 20:35

1 Answer 1

1

This looks like it could be some hash over the original filename, and because they have 32 characters in length, it's likely to be a md5 hash. Or, it might be one of the sha* variants, cut after 32 characters.

If you have access to a linux system, you could try something like

$ echo -n 'introduction.ogg' | md5sum
dc8f2a080281b924622580a8d662874c

and if that doesn't match, try sha1sum, sha224sum, sha256sum, sha384sum, sha512sum instead. These all result in longer results, so your filename might be at the start, the end, or somewhere in the middle of the result.

Or, just paste your file name into this online tool which has those and many more algorithms.

The bad news is, you won't be able to guess the original filename from the hash. All these hashes are (intended to be) one-way functions - it's easy to get the hash from the original data, but there's no way back. This is why hashes like these are used for password storage - you can verify a password by encrypting it, but you can't get at the password from the hash.

2
  • Nice! That was exactly it - thanks. Pity about not being able to recover the file names though :/ Still though - one mystery solved!
    – Tspoon
    Aug 3, 2015 at 20:57
  • in windows you can use utilities like hashmyfiles (nirsoft) C:\hashmyfiles\makehash>copy con inhash.txt introduction.ogg^Z 1 file(s) copied. C:\hashmyfiles\makehash>..\HashMyFiles.exe /file inhash.txt /stext outhash.txt C:\hashmyfiles\makehash>cat outhash.txt ================================================== Filename : inhash.txt MD5 : dc8f2a080281b924622580a8d662874c SHA1 : ca93b978c255ef2c8546b8ec14c3bfd7fd4b5e8c CRC32 : 527a3a01 SHA-256 : a59b9b9b95c8a641498251a7ef406365e01769d8d2bbc19a4b1536908961 96fb
    – blabb
    Aug 4, 2015 at 4:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.