[XignCode] Log decrypt

[psch0]

yo guys, with a byte array wich is key you can decrypt some of xigncode log ^^

[ Key ]

 Spoiler

static byte[] KEY = {
0xAE,0xE5,0x86,0x25,0xB4,0x36,0x7E,0x41,0x9A,
0xDF,0x9F,0xC3,0xF3,0x9F,0xE2,0x18,0xCF,0xDD,
0x38,0xA0,0xB5,0x23,0x0A,0x5F,0xF5,0xFD,0x5D,
0x93,0x19,0xD7,0x69,0xEB,0x39,0x3F,0xB8,0xE2,
0xF8,0x09,0x50,0x96,0x0A,0x4D,0x24,0xD1,0x3C,
0xE1,0xF5,0x0F,0x9F,0xC3,0x06,0x2D,0x21,0x12,
0x11,0x55,0x57,0x16,0x4F,0x60,0x00,0x67,0x78,
0x6F,0xE4,0x4A,0x5B,0xE0,0x36,0xE3,0x77,0x29,
0xF1,0xA1,0x1C,0xA9,0x98,0x5F,0x39,0x4B,0x4A,
0xA3,0xAB,0xD9,0x39,0x20,0xD1,0x82,0x90,0x16,
0xF7,0x9F,0x7A,0x8F,0x65,0x78,0x37,0x83,0x10,
0x40,0x04,0x68,0x40,0xC8,0xB0,0x6E,0x99,0x7D,
0x7E,0x69,0xB4,0x81,0xD2,0x7F,0x41,0xF7,0xD1,
0x2D,0x35,0x69,0xFC,0x77,0x1C,0x87,0x8B,0x88,
0xEE,0xA2,0xCD,0x9D,0x98,0x09,0x4A,0x78,0x54,
0x37,0x09,0xD5,0x67,0xF3,0x11,0xD6,0xBD,0xEE,
0xF6,0x9A,0xCE,0x58,0x7A,0x1E,0xE3,0x70,0xDD,
0x83,0xD8,0x6C,0x59,0xFD,0xA6,0xDF,0x14,0x30,
0x17,0xB7,0x53,0xC8,0x51,0xAA,0xBF,0x72,0x37,
0xFD,0xBE,0xF9,0x49,0xD5,0x69,0xD9,0x16,0x97,
0xEE,0xF5,0xAD,0x96,0xD2,0xC2,0x99,0x5E,0x02,
0x6B,0xDF,0xA5,0xA9,0xA7,0x89,0x1D,0x6D,0xD1,
0x71,0x63,0x76,0x50,0x29,0xCF,0xC6,0xB8,0xB3,
0xF2,0xB9,0x95,0x30,0xBA,0xE2,0xD8,0x43,0x7A,
0xD1,0x09,0x89,0xD8,0xC8,0x19,0xA1,0x72,0x30,
0xFE,0x3E,0xD6,0x91,0x57,0x31,0x47,0xD6,0x15,
0xA6,0x89,0xDE,0x7E,0x55,0x93,0x89,0x26,0x7C,
0xB9
};

[ How to decrypt ]

Basicaly all the encryption algorythm is XoRing every byte with a KEY, as far i got this every encrypted byte has it's own key
so for a single encrypted log file there is a message with a maximum size of 320 bytes.

First 68 bytes are HEADER
Other bytes are Log MESSAGE

here is a image of example below



HEADER is always the same, it's never changing and it does NOT contain any sensetive information ^^
MESSAGE you start decrypting it with KEY, it won't work if you would start decrypt it with HEADER, you will get those junk bytes

Decryption Algorythm in program (will look something like this)

 Spoiler

static int HEADER = 0x44;
static int BODY = 0xfb;
byte[] EncLog = LogRet(readf);//readf <- is filename("xigncode.log" probably)
byte[] DecLog = new byte[EncLog.Length];//decrypted bytes...

for (int i = 0; i < BODY; i++)
 {
     if (i > KEY.Length - 1) break;
     DecLog[i] = (byte)(EncLog[HEADER + i] ^ KEY[i]);
}

[ Some log i decrypted ]

 Spoiler

x3:: Init XIGNCODE3 System Apr 15 2015 18:06:46 4 C : \ A e r i a G a m e s \ S 4 L e a g u e \ x i g n c o d e\ x i g n c o d e . l o g
x3:: XIGNCODE3 Running Check ok! A e r i a G a m e s \ S 4 L e a g u e\ x i g n c o d e\ x i g n c o d e . l o g
Get UpdateProtocol fail GE=e0010001
Get UpdateBase fail GE=e0010001 001
UpdateUrl
update result = 00000000 L ?
??&:? Q$

P4 ? 4 ??
?????4 _ n o n f??e c 8 0 f 0 |4 ? 4 ??
?????4 \ c o m c t l 3 2 . d l l . d l l

[ Info ]

Remember, with this KEY you are not able to decrypt everysingle byte in log! ^^
please don't flame me hard, i've worked hard to get those bytes and trying to understood the algorythm

[pkedpker]

Anyone know the new XOR keys? seems doesn't work for newest xigncode

[psch0]

Originally Posted by pkedpker

Anyone know the new XOR keys? seems doesn't work for newest xigncode

try to trace Kernel32.CreateFile -> lpFileName "xigncode.log"
search in that direction

[ugurkib]

hi guys. i have an error. xigncode.log which program says me error .

[Ⓜiku Ⓗatsune]

Originally Posted by ugurkib

hi guys. i have an error. xigncode.log which program says me error .

Attach (No Link!) <-- .log to in the eMail.
You will get an auto answer by bot and tell you what is detected.

[srwilson987]

i am having an error with xigncode but i send them the email and everything they say is to install an antivirus scan and reboot your pc.