![]() |
|
#9
|
|||
|
|||
|
So it read the last 48bytes Then do a 0x2E xor on it.
hxxps://i.ibb.co/bWtK403/ecrypt-decrypt.jpg Note that the user_id and the video_id is embedded within the file (also stored at the end of the file) So here is the data structure starting from the end: 48bytes xored with 0x2E corresponding to the header of the file. 8 null bytes(delimiter?) UnknowInt32 8 null bytes(delimiter?) UnknowInt32 UnknowInt32 8 null bytes(delimiter?) UnknowInt32 video_id (int32) user_id (int32) EOF (for the video file) x bytes[FileContent] 48bytes[] that needs to be replaced by the end bytes xored for the moment they seem to be useless. So by applying that I was able to retrieve your mp4 files which are from https://fr.tuto.com/after-effects/gratuit-initiation-complete-d-after-effects-after-effects,49795.html (I didn't remove your user_id/video_id) https://www.sendspace.com/filegroup/RMqSpPbmzMobgzR7U5kRGg Btw you can get your user_id, just connect to tuto.com, inspect the src code and at the bottom, there is your user_id Next step create a python script to automate this, but should be trivial will probably have more time next weekend ![]() Enjoy ![]() BTW hxxps://www.relyze.com/beta3.html is amazing and free for non-commercial project
Last edited by yologuy; 04-05-2020 at 19:47. |
| Thread Tools | |
| Display Modes | |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Help with AES 128 encrypted file | phroyt | General Discussion | 6 | 04-28-2020 09:57 |
| Reversing obfuscated and encrypted JAR file | Chuck954 | General Discussion | 8 | 10-11-2019 10:04 |
| Is it possible to crack encrypted file? | wenij | General Discussion | 8 | 02-19-2005 20:20 |