XML videos decrypt help

Extraction and unpacking of game archives and compression, encryption, obfuscation, decoding of unknown files
raykingnihong
Posts: 71
Joined: Fri Oct 24, 2014 3:13 pm

XML videos decrypt help

Post by raykingnihong »

This is an encrypted XML files and guessing is FLV or SWF files. How to decrypt, ask God to help here is a sample file https://onedrive.live.com/redir?resid=6 ... file%2cxml
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: XML videos decrypt help

Post by aluigi »

The file is simply xored with 0x05.
You can use my xor tool or the following script:

Code: Select all

get NAME basename
get SIZE asize
get XOR_VALUE byte
savepos OFFSET
math SIZE -= OFFSET
filexor XOR_VALUE
getdstring EXT 3
string NAME += "."
string NAME += EXT
log NAME OFFSET SIZE

*script updated to work with any file*
raykingnihong
Posts: 71
Joined: Fri Oct 24, 2014 3:13 pm

Re: XML videos decrypt help

Post by raykingnihong »

aluigi wrote:The file is simply xored with 0x05.
You can use my xor tool or the following script:

Code: Select all

get NAME basename
string NAME += ".flv"
get SIZE asize
filexor 0x05
log NAME 0 SIZE
My good friend, thank you very much for your help, I am testing the script and FLV files are extracted. But that doesn't play FLV video files, FLV video I compared the other seems different here are sample https://onedrive.live.com/redir?resid=6 ... =folder%2c
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: XML videos decrypt help

Post by aluigi »

Probably they are modified to avoid playback but the xoring is correct.
raykingnihong
Posts: 71
Joined: Fri Oct 24, 2014 3:13 pm

Re: XML videos decrypt help

Post by raykingnihong »

Thank you, my friends, thank you for your help
MerlinSVK
Posts: 165
Joined: Wed Aug 13, 2014 10:00 am

Re: XML videos decrypt help

Post by MerlinSVK »

That FLV is playable. Just delete first 0x00 byte.
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: XML videos decrypt help

Post by aluigi »

Well done, I have updated the script accordingly :D