Jump to content

6 posts in this topic

Recommended Posts

Posted

Intro:
There's a bunch of tries to to decrypting lua but none of it isnt clear enough how to do it. I'm aware that this approach isnt good enough, because too much step that you'll not need to do but i'm still write it instead. Code in this tutorial ofcourse just bunch of copy-pasta stackoverflow.

Prerequisites
1. Frida (optional)
2. Disassembler (IDA, r2, ..)
3. Python (optional) (I'll use python in this tutorial)
4. A little knowledge about this

What will you need to do?
1. Get the KEY for decryption,
2. Write a script for decryption,
3. Edit the lua (Self explanation),
4. Encrypt back the file (Self explaination) (Same as step 2, but you'll encrypt instead of decrypt),
5. PROFIT.

---- Step by step ----

Get the KEY for decryption
There's bunch of way to do it, some of them:
1. XREFS for XXTeaLuaLoader::setXXTeaKey(string), and you can see it clearly. Most used methods among many games.
nJX33Yr.png
2. Use Frida. I'll explain it on 2nd post.
3. http://forum.xda-developers.com/showthread.php?p=12853986#post12853986
4. etc.. You get the idea.

Write a script for decryption
This is an example of use for XXTEA encryption, requirements(xxtea-py)

 
Code (Text):





#!/usr/bin/env python
import xxtea

chiper = open("assets/script/fund.lua", "rb").read()

out = open("out.lua", "wb")

key = b'mrgj'

out.write(xxtea.encrypt(chiper, key))

out.close()END

Example of use of frida (https://github.com/antojoseph/frida-android-hooks)

As described here, 

Opening the lua files with hex editor reveals that they use XXTEA block cipher.

Analyze libjinqu.so and it blatantly shows the following decryption subroutines:
xxtea_decrypt
cocos2d::extra::CCCrypto::decryptXXTEA

Get a pseudocode generator and copy the program in C++.

. We need to put a hook either at xxtea_decrypt or cocos2d::extra::CCCrypto::decryptXXTEA. Then prints out the arguments passed.
We know that args[2] is the one holding the pointer to key from decompile xxtea_decrypt lib.so
Oh5SCFC.png 
Explaination, v9 is the one holding the chiper text, v30 chipertext len(?), v13 pointer to key, v14 is key.length.
Its obvious if we want to leak the key we need to print args[3] bytes at args[2]. This is an example of use for it.

 

#!/usr/bin/env python
import frida
import sys

package_name = "com.gamebau.pq"

def get_messages_from_js(message, data):
            print(message)

jsc = """
Interceptor.attach (Module.findExportByName( "libgame.so", "xxtea_decrypt"), {
    onEnter: function (args) {
        console.log("----------------BEGIN----------------");
        console.log(hexdump(Memory.readByteArray(args[2], 12),{
         offset: 0,
         length: 12,
         header: true,
         ansi: true
        }));
    },
    onLeave: function (retval) {
        console.log("Decrypt:");
        console.log(hexdump(Memory.readByteArray(retval, 16),{
         offset: 0,
         length: 16,
         header: true,
         ansi: true
        }));
        console.log("-----------------END-----------------");   
    }
});
"""

process = frida.get_usb_device().attach(package_name)
script = process.create_script(jsc)
script.on('message',get_messages_from_js)
script.load()
sys.stdin.read()

profit,
gohBm09.png
 
--Update, forgot to mention about this. Another note, some games tries to pack the assets with common file compressor. While loading it, it tries to unpack the assets on stream. As you can see on the image, its PK file header. With simple google search you can deduce its a zip alike compression. Try to extract the decrypted file with 7zip/Winrar/etc.. and you could see the unpacked file.

Image:
gohBm09.png
 
 
Credits: Wobm And Stack Overflow

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Our picks

    • Soul Huntress: Dungeon Crawler v1.0.3 [+3 Jailed Cheats]
      Modded/Hacked App: Soul Huntress: Dungeon Crawler By Panthera Joint Stock Company
      Bundle ID: com.pantheraplay.soulhuntress
      App Store Link: https://apps.apple.com/ph/app/soul-huntress-dungeon-crawler/id6743422594?uo=4


      🤩 Hack Features

      - Never Die
      - Unlimited Currency (Always Will Increase Spend)
      - Always Can Use Items (Even when has cooldown)
        • Winner
        • Like
      • 3 replies
    • Soul Huntress: Dungeon Crawler v1.0.3 [+3 Cheats]
      Modded/Hacked App: Soul Huntress: Dungeon Crawler By Panthera Joint Stock Company
      Bundle ID: com.pantheraplay.soulhuntress
      App Store Link: https://apps.apple.com/ph/app/soul-huntress-dungeon-crawler/id6743422594?uo=4



      🤩 Hack Features

      - Never Die
      - Unlimited Currency (Always Will Increase Spend)
      - Always Can Use Items (Even when has cooldown)
        • Winner
        • Like
      • 3 replies
    • Tales of Brave doomsday battle v2.1.19 [ +9 Jailed ] ADS NO
      Modded/Hacked App: Tales of Brave doomsday battle By Hakan Aksar
      Bundle ID: com.tianyou.tob
      iTunes Store Link: https://apps.apple.com/us/app/tales-of-brave-doomsday-battle/id6587553322?uo=4
       

      🤩 Hack Features

      - ADS NO [ Rewards Free ]

      - Never Die

      - ONE HiT KiLL

      - Enemy Movement Speed

      - ATK Speed

      - Bullet Max 20

      - Bullet Size Big

      - Enemy Freeze

      - Wall No Hit Enemy


      ⬇️ iOS Hack Download IPA Link


      Hidden Content

      Download via the iOSGods App
        • Haha
        • Like
      • 22 replies
    • Tales of Brave doomsday battle v2.1.19 [ +9 Cheats ] ADS NO
      Modded/Hacked App: Tales of Brave doomsday battle By Hakan Aksar
      Bundle ID: com.tianyou.tob
      iTunes Store Link: https://apps.apple.com/us/app/tales-of-brave-doomsday-battle/id6587553322?uo=4
       

      🤩 Hack Features

      - ADS NO [ Rewards Free ]

      - Never Die

      - ONE HiT KiLL

      - Enemy Movement Speed

      - ATK Speed

      - Bullet Max 20

      - Bullet Size Big

      - Enemy Freeze

      - Wall No Hit Enemy

       

      ⬇️ iOS Hack Download Link


      Hidden Content

      Download Hack
        • Thanks
        • Winner
        • Like
      • 14 replies
    • Raptor Evolution: Survival v1.0.19 [ +3++ Jailed ] Everything Unlimited
      Modded/Hacked App: Raptor Evolution: Survival By Estoty LLC
      Bundle ID: com.raptor.evolution
      iTunes Store Link: https://apps.apple.com/us/app/raptor-evolution-survival/id6738051188?uo=4

      Hack Features:
      - Resources
      - Energy Cost
      - DMG
      - Upgrade Easy


      Jailbreak required hack(s): https://iosgods.com/forum/5-game-cheats-hack-requests/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Agree
        • Thanks
        • Winner
        • Like
      • 14 replies
    • Raptor Evolution: Survival v1.0.19 [ +3++ Cheats] Everything Unlimited
      Modded/Hacked App: Raptor Evolution: Survival By Estoty LLC
      Bundle ID: com.raptor.evolution
      iTunes Store Link: https://apps.apple.com/us/app/raptor-evolution-survival/id6738051188?uo=4

      Hack Features:
      - Resources
      - Energy Cost
      - DMG
      - Upgrade Easy


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/


      iOS Hack Download Link:

      Hidden Content

      Download Hack
        • Informative
        • Agree
        • Thanks
        • Winner
        • Like
      • 15 replies
    • Vampirio: Defend & Survive v1.1.8 [ +2 Cheats ] Currency Max
      Modded/Hacked App: Vampirio: Defend & Survive By Outfit7 Neo Limited
      Bundle ID: com.outfit7neo.onehelsing
      App Store Link: https://apps.apple.com/ph/app/vampirio-defend-survive/id6670539564?uo=4

       

      🤩 Hack Features

      - Currency Max [ Disable After Get ]
      - Resources Max [ Use Only Resources - Disable After Get ] Becasue Linked Population When You Build Disable OtherWise Crash

        • Winner
        • Like
      • 7 replies
    • Vampirio: Defend & Survive v1.1.8 [ +2 Jailed ] Currency Max
      Modded/Hacked App: Vampirio: Defend & Survive By Outfit7 Neo Limited
      Bundle ID: com.outfit7neo.onehelsing
      App Store Link: https://apps.apple.com/ph/app/vampirio-defend-survive/id6670539564?uo=4


      🤩 Hack Features

      - Currency Max [ Disable After Get ]
      - Resources [ Use Only Resources - Disable After Get ] Becasue Linked Population When You Build Disable OtherWise Crash
        • Agree
        • Winner
        • Like
      • 9 replies
    • Heroes vs. Hordes: Survivor v5.2.0 [ +11 Cheats ] Currency Max
      Modded/Hacked App: Heroes vs. Hordes: Survivor By Swift Games GmbH
      Bundle ID: com.swiftgames.roguelikesurvival
      iTunes Store Link: https://apps.apple.com/us/app/heroes-vs-hordes-survivor/id1608898173?uo=4

       
      Hack Features

      - Currency

      - Resource

      - Gold Unlimited [ Bonus Wave ]

      - Ch Unlocked [ Play All Off ]

      - Always Last Wave

      - Talents Cost 0

      - Hero DMG Only

      - HP & DMG [ Just Equip & Unequip ]

      - Enemy Freeze

      - Enemy ATK NO

       
      For Non-Jailbroken & No Jailbreak required hacks: https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
        • Agree
        • Thanks
        • Winner
        • Like
      • 75 replies
    • Heroes vs. Hordes: Survivor v5.2.0 [ +11 Jailed ] Currency Max
      Modded/Hacked App: Heroes vs. Hordes: Survivor By Swift Games GmbH
      Bundle ID: com.swiftgames.roguelikesurvival
      iTunes Store Link: https://apps.apple.com/us/app/heroes-vs-hordes-survivor/id1608898173?uo=4

       

       

      Mod Requirements

      - Non-Jailbroken/Jailed or Jailbroken iPhone or iPad.
      - Sideloadly or alternatives.
      - Computer running Windows/macOS/Linux with iTunes installed.

       

      Hack Features

      - Currency

      - Resource

      - Gold Unlimited [ Bonus Wave ]

      - Ch Unlocked [ Play All Off ]

      - Always Last Wave

      - Talents Cost 0

      - Hero DMG Only

      - HP & DMG [ Just Equip & Unequip ]

      - Enemy Freeze

      - Enemy ATK NO


      Jailbreak required iOS hacks: https://iosgods.com/forum/5-game-cheats-hack-requests/
      Modded Android APKs: https://iosgods.com/forum/68-android-section/

       

      iOS Hack Download IPA Link


      Hidden Content

      Download via the iOSGods App
        • Agree
        • Thanks
        • Winner
        • Like
      • 88 replies
    • What Duck v1.0.28 [ +6 Cheats ] Currency Max
      Modded/Hacked App: What Duck By Nexelon inc.
      Bundle ID: com.nexelon.duckwars
      App Store Link: https://apps.apple.com/us/app/what-duck/id6744432301?uo=4

      🤩 Hack Features

      - ADS No [ Rewards Free ]

      - Currency

      - Resources

      - Battle Coins

      - Energy

      - Free Pass [ Claim Unlimited ]
        • Winner
        • Like
      • 12 replies
    • What Duck v1.0.28 [ +6 Jailed ] Currency Max
      Modded/Hacked App: What Duck By Nexelon inc.
      Bundle ID: com.nexelon.duckwars
      App Store Link: https://apps.apple.com/us/app/what-duck/id6744432301?uo=4


      🤩 Hack Features

      - ADS No [ Rewards Free ]

      - Currency

      - Resources

      - Battle Coins

      - Energy

      - Free Pass [ Claim Unlimited ]
        • Agree
        • Like
      • 20 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines