Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #9  
Old 04-05-2020, 19:24
yologuy yologuy is offline
Friend
 
Join Date: Nov 2016
Posts: 18
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 5
Thanks Rcvd at 23 Times in 9 Posts
yologuy Reputation: 0
So it read the last 48bytes Then do a 0x2E xor on it.
hxxps://i.ibb.co/bWtK403/ecrypt-decrypt.jpg

Note that the user_id and the video_id is embedded within the file (also stored at the end of the file)

So here is the data structure starting from the end:
48bytes xored with 0x2E corresponding to the header of the file.
8 null bytes(delimiter?)
UnknowInt32
8 null bytes(delimiter?)
UnknowInt32
UnknowInt32
8 null bytes(delimiter?)
UnknowInt32
video_id (int32)
user_id (int32)
EOF (for the video file)
x bytes[FileContent]
48bytes[] that needs to be replaced by the end bytes xored for the moment they seem to be useless.

So by applying that I was able to retrieve your mp4 files which are from https://fr.tuto.com/after-effects/gratuit-initiation-complete-d-after-effects-after-effects,49795.html (I didn't remove your user_id/video_id)
https://www.sendspace.com/filegroup/RMqSpPbmzMobgzR7U5kRGg


Btw you can get your user_id, just connect to tuto.com, inspect the src code and at the bottom, there is your user_id


Next step create a python script to automate this, but should be trivial will probably have more time next weekend

Enjoy

BTW hxxps://www.relyze.com/beta3.html is amazing and free for non-commercial project

Last edited by yologuy; 04-05-2020 at 19:47.
Reply With Quote
 

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Help with AES 128 encrypted file phroyt General Discussion 6 04-28-2020 09:57
Reversing obfuscated and encrypted JAR file Chuck954 General Discussion 8 10-11-2019 10:04
Is it possible to crack encrypted file? wenij General Discussion 8 02-19-2005 20:20


All times are GMT +8. The time now is 20:14.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )