How to find Encryption/Decryption keys ?

[Taktloss]

Hello,
i would really like to learn more about encryption/decryption keys like in Telltale games. Can *maybe* someone explain a bit how to find such a key ?

Thanks in advance

[maxton]

Often the easiest way to find encryption/decryption keys is to locate the encryption/decryption routines by decompiling the game binary. You could also try using a debugger/memory editor to look in RAM while the game is running, but even then having the disassembly is probably necessary to know where you should be looking.

[atom0s]

Some other methods you can use to find the crypt functions easily is look for string references to paths where the files are located.
Also setting breakpoints on CreateFileA/CreateFileW/ReadFile/WriteFile etc. to attempt to find when the game accesses the encrypted files can lead you back to the functions of interest.

Doing static analysis in a disassembler like IDA makes things easier as well vs. debugging as you can trace around the file much faster.