XORing a database of which I know some of the plaintext [Epic Seven]

Extraction and unpacking of game archives and compression, encryption, obfuscation, decoding of unknown files
kazuma20
Posts: 2
Joined: Sat Jun 15, 2019 5:22 am

XORing a database of which I know some of the plaintext [Epic Seven]

Post by kazuma20 »

I have this file: https://mega.nz/#!L0pmhYpC!GcQUXOSUJRSV ... TA1VF8Hwcc

Out of probably sheer luck on trying as practice I was able to get some plain text while trying to get the key to XOR the file with, but after that I haven't been able to continue.

Not sure if it's of any help but I know this particular string is and will be repeated throughout the whole file constantly: "text_en", same for "text_es".

Thanks.

EDIT: One of the occurences is located at 1B9C8, other at 5BEB8.

EDIT 2: Based on other files it seems the first 10 characters of the file could be YUNADBSET.FILTER. I attached all the other files for if they're useful https://mega.nz/#!j9xHhKDR!W3Vof-9g0oeg ... pwgUtsS8bs
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: XORing a database of which I know some of the plaintext

Post by aluigi »

It may be a long xor key but more probably a pseudo-random xor where each byte is xored with an incremented value.
Anyway you forgot to mention the name of the game.
kazuma20
Posts: 2
Joined: Sat Jun 15, 2019 5:22 am

Re: XORing a database of which I know some of the plaintext

Post by kazuma20 »

aluigi wrote:It may be a long xor key but more probably a pseudo-random xor where each byte is xored with an incremented value.
Anyway you forgot to mention the name of the game.


Oh apologies. Game is Epic Seven. There's no way to edit the title right?

From what I've been reading about someone who's been doing it for one of the files (at least an old version since this file doesn't seem to be anymore on the pack file) it's XOR was 512 bytes if I recall correctly and that the key was listed along with the offset and size of the file in the pack which seems to change every time the file is updated.

Not sure if it would be of any help or have any information but here I uploaded the latest pack already XOR in which all the files including the database ones can be seen and extracted. https://drive.google.com/open?id=1Nn96q ... OV72Ui4cc1