4 ms·
> Well, for the dump file BPK.DAT, the XOR key partially worked, but to make it more readable I XORed it using two bytes 0xAA, 0x00 I'd say the older version t
by pilif 15y ago
> Well, for the dump file BPK.DAT, the XOR key partially worked, but to make it more readable I XORed it using two bytes 0xAA, 0x00
I'd say the older version that was analyzed before wasn't using unicode yet, whereas the later version was.
Very cool how you see the effects of character encodings all over the place - even where you don't expect them.
Also, if done right, the "encryption" should IMHO have been done after the file has been written in its native encoding using an input byte sequence. But seeing that the XOR key had that second 0 byte, I'd say that the encryption was done using a "string" key instead of plain bytes.
And don't get me started on the idea of using XOR as "encryption" - especially with repeated pattern like this, this can't even be reasonably called obfuscation IMHO.
- ajross 15y agoPeeve: Not unicode, UTF16. Unicode apps aren't synonymous with wide characters (though on Windows you're pretty much stuck as that's what the API picked, sigh), and in fact UTF8 is an objectively better encoding for almost all users.
- pilif 15y agoYes. Probably even UCS2 - I stopped doing a lot of Windows API stuff before I was running into situation where I need characters outside of the basic multilingual plane, so I couldn't say how wcslen("💩") would behave. But I was talking about the build of the software. The old was probably a build linking against the old ANSI API ("A" suffix), whereas the new one is using the wide version ("W" suffix), usually referred to as the Unicode variant of the API - hence my incorrect terminology. Looking at the screenshots of that application, if I had to take a really wild guess, I would say that the application might have been built in delphi which moved to the Unicode API with Delphi 2010 IIRC. That changed the byte-width of a the standard Delphi string (and the more basic PChar type) to 2 bytes and switched over to using the W-suffix API. I guess all those years of doing Delphi work are rubbing off.