Seal of Evil files

[hackspeedok]

Please help me decrypt somes txt,ini and dlg file. Thanks aluigi
https://mega.co.nz/#!plERzT4L!osVmy2wjH ... xP4WpPfDjY

[aluigi]

Unfortunately the comtype scanner didn't find the compression algorithm.

[hackspeedok]

thanks

[hackspeedok]

Can you help me with this file ?
https://mega.co.nz/#!049RzLQC!znSkpNopz ... bGMugTVEK0

[aluigi]

One thing that I noticed is an obfuscation that performs a XOR with the bytes of this key 05 BF ED 6F 75 3D 9A B1 E3 56 87, but it's not related to the compression.

[aluigi]

Ok it's a simple xor with the byte 0x78.
If you need a script:

Code: Select all

get TMP byte
if TMP == 0x80
    savepos OFFSET
    filexor 0x78
    get SIZE asize
    math SIZE -= OFFSET
    get NAME filename
    log NAME OFFSET SIZE
endif

[hackspeedok]

Ok it's a simple xor with the byte 0x78.
If you need a script:

Code: Select all

get TMP byte
if TMP == 0x80
    savepos OFFSET
    filexor 0x78
    get SIZE asize
    math SIZE -= OFFSET
    get NAME filename
    log NAME OFFSET SIZE
endif

Sorry aluigi, i dont understand what does it mean
http://i.imgur.com/gN4pih4.png

But when i extracted soe.exe with 7zip, i recreceived some files like this. Can you help me again ?
https://mega.co.nz/#!khlEDDjI!UI4ZZa9yO ... QHtY6NeWyU

[aluigi]

That file sealofevil.txt doesn't exist.

The script is meant for the obfuscated files like Ini\DialogInfo.ini

Don't use 7-zip on the executable if you have no idea of what you are doing.

[hackspeedok]

Soe.exe is english patch. I think ".text" is string file. Can you help me?

[aluigi]

https://en.wikipedia.org/wiki/Portable_ ... ble#Layout

[hackspeedok]

Thanks and sorry for my bad knowledge