Thanks everyone for sharing keys.
Quote:
Originally Posted by adek1994
Long time no see, saweet. Nice to see you again on ePvP's 9D section. You told it's easy to figure out the encryption keys. Can you tell - how?
By the way - thanks for great update.
|
The 2nd key is obvious because it's only used in 2 byte characters and only ever used in the 2nd byte position. They use XOR encryption so it becomes very obvious when null is XOR'd, because 0 XOR N = N. Thus N is the 2nd key.
The 1st key can be learned by knowing the most common character in a string, with that you can guess the possible keys. What I did was grab all the table names in both an unencrypted and an encrypted XSD and compared string length to find matches as possible candidates for the real value. MobModel_XMS was a good choice because we have 3 Ms in a single short string. With that I found ZxuZxsr{HOZD of the same string length in the encrypted file. Notice the pattern, 3 Zs in the same position?
If you know Z (5A) in a string is really M (4D), all we have to do is figure out what possible XORs of 4D will equal 5A to get a list of possible keys. I did this in python and had the key in a fraction of a second:
Code:
>>> [hex(i) for i in range(256) if 0x4d ^ i == 0x5a]
['0x17']
Lets see what happens (ciphertext is "ZxuZxsr{HOZD" in hex)
Code:
>>> ciphertext = bytearray([0x5A, 0x78, 0x75, 0x5A, 0x78, 0x73, 0x72, 0x7B, 0x48, 0x4F, 0x5A, 0x44])
>>> bytearray([ciphertext[i] ^ 0x17 for i in range(len(ciphertext))])
bytearray(b'MobModel_XMS')
>>>
Viola