lambwheit / cocos2dx-xxtea-decryptor Goto Github PK

The logic of this XXTea is different to this game, if you can help me decrypt their files I would be grateful.
I have been reverse engineering with IDA, but I believe you have more experience.

Game: https://apkpure.com/br/ddtank-origin/com.road7.ddtankbr.gp/download

Some screenshots of what I've discovered so far:

指令 cocos2d.xxtea.decryptor.exe palmpi horcruxmatrix assets
实例文件
1013_hougebo_1.zip

解密后的文件
1013_hougebo_1.zip

看了一下hex,是png格式的应该没错，就是无法预览，密钥也是对的(，但是lua文件解密成功能正常预览

细看了下，有一张图可能导出成功了（不确定？）


7_bg.zip

游戏是盲盒派对，现在在B站测试，能直接下
麻烦大佬帮忙看看吧

(Clarification, I have the key, the signature, the original, encrypted and decrypted file).

I'm using your application correctly (cocos2d.xxtea.decryptor.exe "Key" "Sign" "path\picture.png"), I get the message "Decrypted: path\picture.png"

when I try to open it, the image viewer doesn't show it, it says error. ok, I proceed to verify if the decryption was correct, when I open it with a text editor.

My biggest surprise when I see that it did decrypt the file (it has the characteristic signature "‰PNG .... IHDR", even the text at first glance looks the same, the problem is that it seems to generate noise in the files half way through.

what I mean

Original file size (png valid).
380,668 bytes
Encrypted file size
380,677 bytes
Decrypted file size (invalid png)
382,138 bytes (1,470 bytes of extra noise)

At first it doesn't seem like a big deal, until you enter the file and realize that it is almost the same visually (notepad++ ANSI LF)

both the beginning and the end (the same characters even come out, only with a different length).

for example, I have a line that goes like this "W0®è C'CâHŽå(ÅaeÒ6qµ'‡'4b¡æ¾q"Q©ócšK¶]Å", in the original file it is line 1999, but in the decrypted file it is line 2001

the same happens with the end of the file
IEND®B`' in the original is Ln 2891 col 499, but in the decrypted one it is Ln 2895 Col 449

I tried to change the chcp of my console and the decrypted file is the same (hash md5)

original

‰PNG
�

IHDR � � �� ��+ƒ pHYs �� ��� šœ� IDATxÚìÝw˜]W}/üïZk·Ó§«[’%wIî�cp!ÆƘfƒ©¡„ É��É{ó���7¹‰�!���Þä¦Â
...
°¾v�.�ÅÉÉ�ã<Ãmë§GƒPü/�º%—ðÑohò"ŽWŠ,ûv ? à €—ÁFþ�c,�Œ1Æ�cÌ×&òѵy‘�/€'�x�€ù…nŸ.ßw�ö,ïÆb¯�ï<†£�Ö·×púô}z÷©c�97f¢¿<5�ýQJüæA‘�ìÑ4Æ�K �cŒ1Ƙ�$ù Ç|5�O"Gߦ‚#Aä43��!(€‰sî]�t´�ÅŸ;=�ÚØ=cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�s~ÿ�––P=èTµº IEND®B‚

Decrypted

‰PNG

�

IHDR � � �� ��+ƒ pHYs �� ��� šœ� IDATxÚìÝw˜]W}/üïZk·Ó§«[’%wIî�cp!ÆƘfƒ©¡„ É��É{ó���7¹‰�!���Þä¦Â
...
°¾v�.�ÅÉÉ�ã<Ãmë§GƒPü/�º%—ðÑohò"ŽWŠ,ûv ? à €—ÁFþ�c,�Œ1Æ�cÌ×&òѵy‘�/€'�x�€ù…nŸ.ßw�ö,ïÆb¯�ï<†£�Ö·×púô}z÷©c�97f¢¿<5�ýQJüæA‘�ìÑ4Æ�K �cŒ1Ƙ�$ù Ç|5�O"Gߦ‚#Aä43��!(€‰sî]�t´�ÅŸ;=�ÚØ=cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�cŒ1Æ�s~ÿ�––P=èTµº IEND®B‚

A small request, add an api mode to be able to use the program in other more automated codes and support for hexadecimal mode (because using ansi/utf is sometimes chaotic, and more when you have line breaks as part of the signature or key... is complicated).