Android - get LUA file key

[bykjamnik]

Hello every1!

I need some help and tips how to get a key to decrypt LUA file located in APK.
I searched forum and few sites and found out that sometimes key is stored in:
- AppDelegate::applicationDidFinishLaunching
- cocos2d::ScriptEngineManager::setScriptEngine
- register_<misc_name_here>_module
- main.lua
but except main.lua i cant find any of those at IDA with mine *.so file.

So I simply search for *lua*. There is some load.lua, main.lua preload.lua but im not skilled enough to get something from it.(screen in attachment). Should key be there?

All lua files in APK have same header [1B6E78735201010404] nsxR which indicate that files are encrypted. (lua file in attachment)

*.so file - there is only1 and located in lib folder (so file in attachemnt).

Thank You very much for all help/tips You provide!

[Ekey]

LUA not ecnrypted, just compiled to bytecode. These files are not stock Lua at all. They are using a modified version.

[atom0s]

As Ekey mentioned, this is not a stock/standard setup for Lua.

The header has modifications such as:
- The signature is altered from Lua to 'nxs'
- The format byte is set to 01, which is not standard for Lua which uses 00.
- The header tail is modified from the expected: "\x19\x93\r\n\x1a\n" to "\x19\x6E\x78\x0A\xF0\x0A"

The .so file looks to be using this Sandbox engine:
https://github.com/andryblack/sandbox

However, the Lua lib being used is modified from what that engine has bundled.

[bykjamnik]

Ekey & atom0s - Thank U very much for Your answers!

So basicly there is no way to make it "human" language even if i know what should be in this file.
Was really hoping its possible to find something in code that can translate and open *.lua

This game basically have strange files in. Even png files are *.nxi format. And there is also some *.nxa which i have no idea what they are.

[atom0s]

Didn't say there was no way. You need to build Lua yourself to match the expected setup that this is using. The header needs to be updated, the types need to be adjusted to be what the scripts are set for, etc.

Opcode wise, there may be alterations there as well, I didn't dig into further than checking the header out. If there are, those will need to be dealt with as well.

This game basically have strange files in. Even png files are *.nxi format. And there is also some *.nxa which i have no idea what they are.

If png's are .nxi, I'd assume the 'i' stands for image. If that's the case, .nxa is probably audio.