Can you share the binary? It'll be pretty difficult to contribute anything other than guesswork, otherwise. If not, maybe you could try comparing sequential hashes - A, B, C, etc. - the more data, the better.

It could well be some kind of token/hash/checksum etc. but it's difficult to say without digging into the code. When you watch other videos, do the s parameters look similar at all or are they totally random? If you can view videos on their website rather than the app, it might be easier to use browser debugging tools to look through their JavaScript.

If that's an xxtea-decrypted file then the decrypting process for its contents probably happens in one of the .lua files rather than in the .so binary; you should share the decrypted files, too.

I don't know about the mobile app as I only tried with the free links; you might be able to include your session token/login details in the requests. Your error sounds like it could just be your firewall. I suggest opening an issue on the GitHub page if you have any issues with the script - as far as reverse engineering goes, this has been solved and the question should be marked as completed.

I made a spreadsheet which contained order data/codes for just under 200 receipts, most of which I found by scraping the McDonald's UK Twitter account. It still took me a while to figure out, but by sorting the data by the "order number" column I eventually noticed some characters repeated every 25 orders. It was pretty trivial to fill in the blanks from there.

@ĐứcNguyễn take a look at the GET requests to api.gohitv.com. Each request has a did header (which is a random 24 char string) and returns a timestamp along with encrypted base64 data. Calculate md5(md5(did + timestamp) + "Wcb26arWkvkcAZc378eR") - first 16 bytes is the key, last 16 bytes is the vector. The Wcb2 ... value is a hardcoded AES key on the page.

Might be worth trying a few different deobfuscators - this one does a decent job of decoding a lot of the strings: deobfuscate.relative.im

Is it the same game as your question here?

Any background info on the file? Where's it from?

What's the software? You could try manually editing those values (e.g. all 0x00 or 0xFF) and see if anything happens when you load the file.

Nope, never heard of that.

I used github.com/xxtea/xxtea-php/tree/master. Remember to ignore the GuoSig bytes..

Uploading the file and the program/binary would indeed be very helpful.