Could you please give advice on decrypting the text?

Leundo commented 1 year ago

I found some interesting UTF16LE encoded strings in dumped memory, but I have no idea to decrypt them. I would be very grateful if you could provide some advice (I have poor background in cryptography). Three samples:

H4sIAP40gmQA/6VaTW/cyHYtFtn87A+JrZZk+XOssWW7PdbYPdMYAlEAta2Z0Ys0GtjWixYBGu1uqsVxi1S6KY2NLNxZBu8PZJlVECCLAFlll3WC9wOyy0/IKkCAbN65xSKbTckzz4kAgazDe6uKVfeee2+xr+/9hvN/KzNFY0/Z75S2ojBP4YrHVbahaqyjqHxLYSzBdYkbEi8VcEviJpvvx5G4LfGKxKsSLxfwBYnXCrgr8cUCviTxegFflnijgK9KfKUwzzWJXyvgNyR+vYDfkvjNAn5H4rcL+F2Jf1bAP5f4emE970v83kfkNwr4Q4k/KOBNiT+S+BcSfyLxx4X1SfFNYF+yGlPYEVenLmei3UG/fwZsuesPgrj3ZuTvhkH828D/ebkbnPaG/mnv3ci/8EdxcOauv4nDbgrcPA7CwfOTYDTonMdxFP55EJ9snw+CaLELsVSqvD6MutB1usMIl8NR7310Hm8SOnkbjEab65P+OBqNugN/0u9HYdwLQn+8SRM4i8Y5wefZM4JeEbQb+6eL6DdrLKeNTPirS+P14ngcvDmP/bB36m+ux+/ibgaNLpa6AHLtRlG/kg6xKZ9kwpv9uRm+Gfu9t/7xsd+P69DJNZ/9iuYkHvvhMD7BDCFB7zSPNIr6tAZZ46Z8Gr8/80V3dEOLswCp1+l9Tqgs8ZskfDaOhmN/MtlcF5vfHUX9t7XEEOj22bwMLV7/fCw2ehNPgnASDONU9+tyovj1J2l9JbW++iStltRqfZLWM6n17JO0ntYzy98lQHby9OEf00kVq51293Fx0YqjuDcS7TpZ5ax5++Oabja11/67eJH00keLeS3nAg723UE1E68MoxN/dOaPyUxSqUOGqKAyw0PQcDmRiqJ4KmeuxkAcmiCO1W4UPh8F/bf7vXd7NE4nDhvbg4HA9oIJHM0fz1HCnzBFZZyV8r2mNLT60j+NLvyPK/+ryhSduexr0q6D6GYBjStJbyrmqDEPc6wxjR2V+HRDK+Gq4KqzZknB3EuKpxiSDBem1Fdyb07bioU+bJCnwzzVxH9ZTQPhkVKHbAXPq9CvKQlWzenrc/p4K6lXkvjCHJ6Q8GJGwtWxf4x1PzncXeuDL2J/PwjFmu785Xlwth+VfXE9qNLu/dgb905dusvYzggGla6Q2R2kPchdkT0siOv3YqelKLrrnvQG4oFLBP9zL+6fdMNovDJrTfwRmMsfXA4K9YkfC91XZ+Mg9isw7rgX9v364W6CvPLj/SEGm5xEP2M2/14io7rLdr7CotHmJVdFXjk2U8WiaFioEmuqtFmqMsP0KzCjgFnAbIaF5ulCe2KxyTjKMI5KZsCJPDaT14R8G9mKpy6qnuqqs/6W8LyRy0Dqco6rEr+Wy0Dy+HWJr0n8JvBbrK0ik9DuwEA/0zpwpm1FgcwNRgZQ2Q6xvnE0XjhEFH6/Ew6xrQ6xdHQsXbYRYXHJv6LTsyj0QzBKTypViQkueqNz38VdhyLOb6lVIZzC3Tw7NFKhbcSOH/C4lvBbgHBUCFkFxqsLQaG7C+HrZwgn3fOg2xucBpNJEIXd6MwPjcPdqkgIdsLz0zknXuoNBoe7wsmFQCXlkEvEURtiXgdvfsIccmFoeejHQizLOZxun9r5GHcpM5iPolXY7XY/Di78jPrcSSpOwy/EvWF6f32mS4uVwn9Fpqwzp60wwWKJiXHla7WE7VXZn2qK6mkarlyYE20xcnP88cxPMy9cozVLPImm8To4oyQo86cl8YhcndIlf/w7QYSL7Iv/LxG2QYQzHRM6ICrVVj3pIzNys0BiTk62rLThS55ahb/UxAseKeYvyCxki7D2I1nM4W53N3wbhMPuYUjbulpA94AtfO+Po+/G0flZ3prKSHaGQ1CYQEAvM+bbP7g28cOEzqiDl0D9SVwRwMuz/tK7IHwX9ND9T4E/OY8WszYaORv7I3nNFimSw7DwjIl3+xeTYUW/YH+DlZN5O956S5hIupIlETI8EYZ0pSpz8pm8AXmNNcGGCXsxJmQUGzKa7MOYNsWuU32WhhxNhpZkLOp/C7vRRk1G9UCyI1UKtrzCqQ9l6vEFZQvs1+bog7vco/qOow+OuozXgS0Ba2AHl2ERCFVcVZrQ3eIreIYx+DXIruZk16SsKa0OY0g9jxPG2ZGKkIv+k/vKtM2vQ7fCXbChx29wT0MfpVU8h7XqsNrSTVxhtaVbrKnDajmsNhvvNkv7n2F3rsA+m3uHy2PexZgruTHX5ZifZ2O6Kr3vPVofvIvCEt37nNYreRfsK60x35D9PuCJ7EMp+4i3tSbm9lijOZC1WAfw+qXD3YT4QZ1ExBY5wozXVyh0vg7ikb8NFgbl++OqsHUiiDVw4e6Eetnzj+NOr//2DP+zTOL/ENKLRdBcfZHPD3/RlwoOVPCbnKc5wYQcNfGkLE/IMf9c7LiKt4PJD9H4tJckOfXuXNM5AYHsDspdecVyEaVk/rwipF77PcHo+9EANWsXQe04GF6dhOVTqFnmVJZ0DiJyEu2M4X8ta8uI669Vig6L7HGSFzKRFyb3irgHOSTOr1Sm2T1fwb1MhYjOkSIhJZIGaArjVHiik89Nm3hOdOwROXDo8yocuSLHq4nxZnlrqpOkWYnMQpa3LtKe/SiNoiFNT0SxF6jqKwDwnnsXVoyso2hcl2v2K3b4Gnbthyh+hWFeis5e9sYzSl5IQyNW3RrjyfwO7B8UTGJJzrDTm/gUzmuy/bo3/CeNIb9fUQ49GdLbnJZRxXIqbObnSPPBtchQwSuIpJrCUn+ex7nkGkNsRbIlFheRFX02wSdtzWZuCXIa146M+1PPctg3qmFVUXcdWY2pa2MeVpl1LA59i7Ut9G9VLc+uCWzLqqge/l0b22QtWm0Hzx3X6VjIPK0FtW2B/6wlyDvMdVToYD6ijxKwitp0uMA8krUxT9u0XQfZs71su2WTdWz0YzesHUNVXxr/8aGBd1rWmOaVHNYoldhDcOO+hqhvok+zZIr5W4aFOVlNG+tiqsqB9j8faG1q2EWssWA4MgUHG+iPY1scO7mUt3UpL93HVix+hwwvzXBNWMxcZtcfAd8NwZJ93xhGdfR7iJ5e9OLe6zfdfOLmBGe9YDyRIxNypdWkZyBXmF4tDEbR2D89i987yAKRl5joP6UI/g82g7M8Vf9ZeQyH9FSK8Ng5Dc4Gi0GxrLpIBD1VVb0SVkjHbuolvW3ASQ3D6Kgl1YXFuHDgI9Uu6JhCp61DVjf0jqplsonlWDnLeQXLsXOWc19ajpOznErBcspqgi0CK6sbjstmVlORVkN4Q+L1Ar4i8WWJX5P4msRXgSPKWjeA2znrI9mbQja1vhm2qq45zDAdEJbDp026lpXpTA5rYXErsfZbsHa0He64ZeSczm3Hq9wxOxhn21J420bEt7m05ru2V15QNyrrzKt+bt2vVCsdG4Rp11XPqVtbzj0bFo/7ZZPuE2v/R2ntHNZuF6wd8zVvmmLNhbWX56y9DUbwoOfSnmv3NU/fwH5jP4wHRkfTVJEZ6benbR396Dd1z3jImibeUcc76pi3znWXbES/q3vmI7ZhrTPX1th9y7Y6OuatN1nbeIz+vjBceF7HwH4a93RPfyLxTeClDE/G+VKM09FB7HqpMLYixiYvbZAPTPZ6k/hV8GYEe78O5yGa/NEf9+GNoqR8FY/na8yGFBIIeXE+TF6qNAsFZKHaLIv7vYvUye4NZSbx/HyMMizpau+COtsRCoJNEHmrVLrScW53aSL44zQKr8w+KhSAyOGXKHt60Xm/LdsrMj3YTgPU84MZJ8zxlU1nvMPZAZo1jDrDWQVuX/xC5W2FhWp7vry2CLtcsc7RXsZPl/nvI8WqpELKF5FeifVMYiIJXZtEY7F/30bjnTS1rNFKJARpi9wrS2lW0h2Z9XAlr2YRWGP8bxFaHYTW/bRa9mRoFUUqiJCKUhScnMJlGm6rFG7pVA2lgwidqp2F2yPuFXAuyxOQI8oYl+RUkCMczTPL7Buum6I/c2nqWpgDnLhjghzRR9tEP2YNDr0gsC2zyhPMBVblG3adnBv4IvAl4A2TwrJrc+H0HvAtY9lMdCyh05TPdnSQif6fHxp4p2WVoQQps4amsYcowPdVkIkBHcMyxBxN3fTMqtm0MHcDZKImofNyvKyJwwrx2WTeuChazp19zNmNAx84/a5oMvMnH9JSsk8dV0RFK8RI5fUX3vaX7W+zBC/bbvhilkSnppLlg+JwJccO/O9LDEnmGvuLWYG8PH2InPchB+Vi1fYVZ9rGanklXnL1Eq5qacNAKAT13TdM4xvDYBtEdyVNOVD++0NbAXWiiPakdaR565HyFLmyLcd4MKVjwTYvi0KQPmC2tVqOthdA2ygWEYq3kUFvcUe53G+SQ8/PdfFX5wprEZalokg+MlFsYu5HFopNsy7f4b8+HCl0lnz1e3gKLBAFtMcbhXkt51IQ6Kso0tVVUfR62jU6buR1VWXpMUxatCwHE/jr5PyUDEvsTH5/5Ke7hALmPilcfzPsZiXfAJzzU9AdBJPL9vAZHdjlyZu006PpPGGYm/cmzjGRSiyzLWH5hQQ+VxsWPo1cYaorlyfpJMXnpx5d5095HtFHDIVp+VKN8BU6C30+ilBZpBX991TVafNfUdpUCiApTHfCFiq/cg7we4XBYE22Mn8kp4iDGExAO9LUqWuUKH0oUZjf0cA82v9+oPowGVkTX1qa4qi9xJKrLq+GOIL+5EPQqz7ZpMexYKd4HL2nYCJJpdoNpN7fwbGQybLNNtZ0Q6HSKYkHHYYkCAu2QT9JQDWLNm/hxWmGLXjvFsiihaqVjrZaShXXCq4LjH5i0FJcRj8paMFD6KC+pSwz+slAS1lldEDfUtYY/SSgpdxg9BOAlnKL0Sf/lnKH0Sf+lnKX0Sf9lvI5o0/4LeU+o0/2LeUBo0/0LeURrg/ZM8ame4glzI3CF7OXvGr7WZkOt4GwxSikc5pvgzCYnMwXzexS1cyKVSrLlam5L0XMSXqlmRyeDXqxL44YWHamzpZx9z1ym/FeEL5NoeLX/iu/47HFsdjbnQs47oRVe4OBvK1FYapZoQnSjSt8aTc8jqhl90e9ycSZ+D5cs0xnUvC45mk0OB/5kyejaBj0nwh2eEKHIU/mdJ1EjP0BGGAmTtAiAAA=

H4sIAH80gmQA/12OzUrDUBCFz530x5hi3bjqA4gIWSgEXLhJKZTaRaD4AOPtxGInTbg3Kt35Br5yb2wXxcVwmDMz55vJckH0AUPoI743wHOooxpkJgpKp76HFxgkDTuu/CRnL7Oqafcr62rVOe/WKu5686dTZe/HYVN2bcHt5qpxUvLbq9PfEBnhAqMMwG3HIMITRZQjMhl6wesjB9GjGQbmAA/AzxIExLat3c0ZsugeubQdKvEirDpq2G75Xe7KMJHv2m3T6sumVb0WTf9fJsH+VMEBq9BUEAIBAAA=

H4sIAP00gmQA/y3U11JiARRE0cttMecsmLMYAAGzmEURc845fMh80nzgWNP7ba/zeqo6XiqG4Z+GMFBQCv6G2eAoyEYU5MIgyIeRSD4SwREc4hALC5fhMhzFUVyOy3EFrsCVuBJX4SpcjatxDa7BtbgW1+E6XI/rcQNuwI24ETfhJtyMm3ELbsGtuBW34TbcjttxB+7AnbgTd+EuHMMxHP/1768i3dzj3HtwN+7FPbgP9+J+3IcHcD8exAN4CA/iYTyER/AwHsUjeAyP4nE8hifwOE7gCTyJE3gKT+JpPIVn8DRO4hmcwkmcxik8i9M4g2dxFmdwDmfxHM7heTyHF/A8XsQLeAkv4mW8hFfwMl7FKziPV/EazuN1vIY38DrexBt4C2/ibbyFd/A23sU7uIB38R4u4H28h4t4Hx/gIi7hA3z4u2dh8DtHgX50Hf0f39pxfOnb8akvx4c+He/6cLzp3fGqN8eLXh3PenE86dnxqCfHgx4d93pw3Onecas7x41uHde6cVzpx3GpK8eFLh3nunCc6dxxqjPHiU4dx9p2HOnYcagjR0mHjgPtO4o6cOyr5NhT0VHQiWNXBceOFhzbWnRsac+xqQ3HhnKOdY068hpwrGndsaIRx7KGHUvKOxa161hQzDGvHkdOc46sNh0ZZR2zyjjSmnWklHYklXLMKOmY1oxjUtOOhCYdE0o4xjXhGNO4Y1RjjhGtOYa14hjSsmNQQ44BDTr6tOToVZ+jR72Obs074up2xBR3dGkrGvwDzdfYoYwHAAA=

zv6fc8ePrk8OkxOsqE0TLUtyxvioiuetnBw6dHAhWPT2TeL54GN5wenGgNAkZKf1At5zZy8p5ZDe0W2xxaNy3ZFhYdWCPvzmorxydHxYO9k0fFA+N2EOi3v6eo253pwUW6rI5xpWdatVeXf1x6+uCxlvD06PZp8c5R8f5j3DKh2/DxIdWXis+KJVo1Hka/G29CyzjbhukPenq4KzQenh4/IqGBniVZnuo8yEDdob517Q3rjyfUaS+9LTPene9u5e9elH3i3ZNijBeGq29R3pLuHrnOOBjTEBlQIG/M9L1BfX8Q48CSbhFTg0pk+wAbhdxM72AaAk+7H7a7orPvjM1oDG37tnT/cvdjhvsLZNsovQIt2X5zyd6VQYcDLctunofyYNxVGxf161rztj4FMaWiPl/tx3V1agI9NbKPraGq5UrFXitfvBIfxvjN7WWrojZytfpt81Y/+55oqbPauU1f9Glr562rnAHsdfldqqum/wMdwgfWqiIAAA==4SuVUj6O8u6HSM3K7HO+6rrsBsdJzsOpFJjhp/YdwcJz7aobGJBUBgNeBAV4KM+bTVZScQUdnpoICGQNzqmMYoZ31MAZJyKe0hsiQVzLavbwCaFaPylGWLpRsKMT+1GHZ7P8sH/3v/7vyDP/2P8P3qfjulyLP9bEG71SuOhb4OjF0O3bMBI01mv5oSXLbDE98f8BvKihyiyvAQA=

Some features are as follows:

Most of them begin with H4sIAP00gmQA/ (but there are exceptions, i.e. 4SuVUj6O8u6HSM3K7HO+6rrsBsdJzsOpFJjhp/YdwcJz7aobGJBUBgNeBAV4KM+bTVZScQUdnpoICGQNzqmMYoZ31MAZJyKe0hsiQVzLavbwCaFaPylGWLpRsKMT+1GHZ7P8sH/3v/7vyDP/2P8P3qfjulyLP9bEG71SuOhb4OjF0O3bMBI01mv5oSXLbDE98f8BvKihyiyvAQA).
They have high information entropy, indicating compression. With counting the number of occurrences of 64 characters, the information entropy of each of them is about 5.9 (the upper bound is 6).
They are encoded in UTF16LE instead of ASCII and stored in memory. So I believe they are encrypted string (May be not).

Hope to receive your suggestions. Best wish for you :)

SunsetMkt commented 1 year ago

I guess it's better to check the il2cpp binary directly.

The game's global-metadata.dat and libil2cpp.so are encrypted and should be dumped from memory while running.

I'm also trying to figure out the game's assets loading, but still unclear.

Leundo commented 1 year ago

I guess it's better to check the il2cpp binary directly.

The game's global-metadata.dat and libil2cpp.so are encrypted and should be dumped from memory while running.

I'm also trying to figure out the game's assets loading, but still unclear.

Yep, I think diving into the disassembly libil2cpp.so with dumped memory can figure out it, and there are some tools to extract function signatures cuz csharp implements reflection . I'll attempt to do it but it takes time (Although not familiar with assembly, this is what I should do).

66hh commented 1 year ago

I guess it's better to check the il2cpp binary directly. The game's global-metadata.dat and libil2cpp.so are encrypted and should be dumped from memory while running. I'm also trying to figure out the game's assets loading, but still unclear.

Yep, I think diving into the disassembly libil2cpp.so with dumped memory can figure out it, and there are some tools to extract function signatures cuz csharp implements reflection . I'll attempt to do it but it takes time (Although not familiar with assembly, this is what I should do).

I guess it's better to check the il2cpp binary directly. The game's global-metadata.dat and libil2cpp.so are encrypted and should be dumped from memory while running. I'm also trying to figure out the game's assets loading, but still unclear.

Yep, I think diving into the disassembly libil2cpp.so with dumped memory can figure out it, and there are some tools to extract function signatures cuz csharp implements reflection . I'll attempt to do it but it takes time (Although not familiar with assembly, this is what I should do).

You can try using frida to dump global-metadata

66hh commented 1 year ago

This is the script I used dump.txt

66hh commented 1 year ago

I found some interesting UTF16LE encoded strings in dumped memory, but I have no idea to decrypt them. I would be very grateful if you could provide some advice (I have poor background in cryptography). Three samples:

H4sIAP40gmQA/6VaTW/cyHYtFtn87A+JrZZk+XOssWW7PdbYPdMYAlEAta2Z0Ys0GtjWixYBGu1uqsVxi1S6KY2NLNxZBu8PZJlVECCLAFlll3WC9wOyy0/IKkCAbN65xSKbTckzz4kAgazDe6uKVfeee2+xr+/9hvN/KzNFY0/Z75S2ojBP4YrHVbahaqyjqHxLYSzBdYkbEi8VcEviJpvvx5G4LfGKxKsSLxfwBYnXCrgr8cUCviTxegFflnijgK9KfKUwzzWJXyvgNyR+vYDfkvjNAn5H4rcL+F2Jf1bAP5f4emE970v83kfkNwr4Q4k/KOBNiT+S+BcSfyLxx4X1SfFNYF+yGlPYEVenLmei3UG/fwZsuesPgrj3ZuTvhkH828D/ebkbnPaG/mnv3ci/8EdxcOauv4nDbgrcPA7CwfOTYDTonMdxFP55EJ9snw+CaLELsVSqvD6MutB1usMIl8NR7310Hm8SOnkbjEab65P+OBqNugN/0u9HYdwLQn+8SRM4i8Y5wefZM4JeEbQb+6eL6DdrLKeNTPirS+P14ngcvDmP/bB36m+ux+/ibgaNLpa6AHLtRlG/kg6xKZ9kwpv9uRm+Gfu9t/7xsd+P69DJNZ/9iuYkHvvhMD7BDCFB7zSPNIr6tAZZ46Z8Gr8/80V3dEOLswCp1+l9Tqgs8ZskfDaOhmN/MtlcF5vfHUX9t7XEEOj22bwMLV7/fCw2ehNPgnASDONU9+tyovj1J2l9JbW++iStltRqfZLWM6n17JO0ntYzy98lQHby9OEf00kVq51293Fx0YqjuDcS7TpZ5ax5++Oabja11/67eJH00keLeS3nAg723UE1E68MoxN/dOaPyUxSqUOGqKAyw0PQcDmRiqJ4KmeuxkAcmiCO1W4UPh8F/bf7vXd7NE4nDhvbg4HA9oIJHM0fz1HCnzBFZZyV8r2mNLT60j+NLvyPK/+ryhSduexr0q6D6GYBjStJbyrmqDEPc6wxjR2V+HRDK+Gq4KqzZknB3EuKpxiSDBem1Fdyb07bioU+bJCnwzzVxH9ZTQPhkVKHbAXPq9CvKQlWzenrc/p4K6lXkvjCHJ6Q8GJGwtWxf4x1PzncXeuDL2J/PwjFmu785Xlwth+VfXE9qNLu/dgb905dusvYzggGla6Q2R2kPchdkT0siOv3YqelKLrrnvQG4oFLBP9zL+6fdMNovDJrTfwRmMsfXA4K9YkfC91XZ+Mg9isw7rgX9v364W6CvPLj/SEGm5xEP2M2/14io7rLdr7CotHmJVdFXjk2U8WiaFioEmuqtFmqMsP0KzCjgFnAbIaF5ulCe2KxyTjKMI5KZsCJPDaT14R8G9mKpy6qnuqqs/6W8LyRy0Dqco6rEr+Wy0Dy+HWJr0n8JvBbrK0ik9DuwEA/0zpwpm1FgcwNRgZQ2Q6xvnE0XjhEFH6/Ew6xrQ6xdHQsXbYRYXHJv6LTsyj0QzBKTypViQkueqNz38VdhyLOb6lVIZzC3Tw7NFKhbcSOH/C4lvBbgHBUCFkFxqsLQaG7C+HrZwgn3fOg2xucBpNJEIXd6MwPjcPdqkgIdsLz0zknXuoNBoe7wsmFQCXlkEvEURtiXgdvfsIccmFoeejHQizLOZxun9r5GHcpM5iPolXY7XY/Di78jPrcSSpOwy/EvWF6f32mS4uVwn9Fpqwzp60wwWKJiXHla7WE7VXZn2qK6mkarlyYE20xcnP88cxPMy9cozVLPImm8To4oyQo86cl8YhcndIlf/w7QYSL7Iv/LxG2QYQzHRM6ICrVVj3pIzNys0BiTk62rLThS55ahb/UxAseKeYvyCxki7D2I1nM4W53N3wbhMPuYUjbulpA94AtfO+Po+/G0flZ3prKSHaGQ1CYQEAvM+bbP7g28cOEzqiDl0D9SVwRwMuz/tK7IHwX9ND9T4E/OY8WszYaORv7I3nNFimSw7DwjIl3+xeTYUW/YH+DlZN5O956S5hIupIlETI8EYZ0pSpz8pm8AXmNNcGGCXsxJmQUGzKa7MOYNsWuU32WhhxNhpZkLOp/C7vRRk1G9UCyI1UKtrzCqQ9l6vEFZQvs1+bog7vco/qOow+OuozXgS0Ba2AHl2ERCFVcVZrQ3eIreIYx+DXIruZk16SsKa0OY0g9jxPG2ZGKkIv+k/vKtM2vQ7fCXbChx29wT0MfpVU8h7XqsNrSTVxhtaVbrKnDajmsNhvvNkv7n2F3rsA+m3uHy2PexZgruTHX5ZifZ2O6Kr3vPVofvIvCEt37nNYreRfsK60x35D9PuCJ7EMp+4i3tSbm9lijOZC1WAfw+qXD3YT4QZ1ExBY5wozXVyh0vg7ikb8NFgbl++OqsHUiiDVw4e6Eetnzj+NOr//2DP+zTOL/ENKLRdBcfZHPD3/RlwoOVPCbnKc5wYQcNfGkLE/IMf9c7LiKt4PJD9H4tJckOfXuXNM5AYHsDspdecVyEaVk/rwipF77PcHo+9EANWsXQe04GF6dhOVTqFnmVJZ0DiJyEu2M4X8ta8uI669Vig6L7HGSFzKRFyb3irgHOSTOr1Sm2T1fwb1MhYjOkSIhJZIGaArjVHiik89Nm3hOdOwROXDo8yocuSLHq4nxZnlrqpOkWYnMQpa3LtKe/SiNoiFNT0SxF6jqKwDwnnsXVoyso2hcl2v2K3b4Gnbthyh+hWFeis5e9sYzSl5IQyNW3RrjyfwO7B8UTGJJzrDTm/gUzmuy/bo3/CeNIb9fUQ49GdLbnJZRxXIqbObnSPPBtchQwSuIpJrCUn+ex7nkGkNsRbIlFheRFX02wSdtzWZuCXIa146M+1PPctg3qmFVUXcdWY2pa2MeVpl1LA59i7Ut9G9VLc+uCWzLqqge/l0b22QtWm0Hzx3X6VjIPK0FtW2B/6wlyDvMdVToYD6ijxKwitp0uMA8krUxT9u0XQfZs71su2WTdWz0YzesHUNVXxr/8aGBd1rWmOaVHNYoldhDcOO+hqhvok+zZIr5W4aFOVlNG+tiqsqB9j8faG1q2EWssWA4MgUHG+iPY1scO7mUt3UpL93HVix+hwwvzXBNWMxcZtcfAd8NwZJ93xhGdfR7iJ5e9OLe6zfdfOLmBGe9YDyRIxNypdWkZyBXmF4tDEbR2D89i987yAKRl5joP6UI/g82g7M8Vf9ZeQyH9FSK8Ng5Dc4Gi0GxrLpIBD1VVb0SVkjHbuolvW3ASQ3D6Kgl1YXFuHDgI9Uu6JhCp61DVjf0jqplsonlWDnLeQXLsXOWc19ajpOznErBcspqgi0CK6sbjstmVlORVkN4Q+L1Ar4i8WWJX5P4msRXgSPKWjeA2znrI9mbQja1vhm2qq45zDAdEJbDp026lpXpTA5rYXErsfZbsHa0He64ZeSczm3Hq9wxOxhn21J420bEt7m05ru2V15QNyrrzKt+bt2vVCsdG4Rp11XPqVtbzj0bFo/7ZZPuE2v/R2ntHNZuF6wd8zVvmmLNhbWX56y9DUbwoOfSnmv3NU/fwH5jP4wHRkfTVJEZ6benbR396Dd1z3jImibeUcc76pi3znWXbES/q3vmI7ZhrTPX1th9y7Y6OuatN1nbeIz+vjBceF7HwH4a93RPfyLxTeClDE/G+VKM09FB7HqpMLYixiYvbZAPTPZ6k/hV8GYEe78O5yGa/NEf9+GNoqR8FY/na8yGFBIIeXE+TF6qNAsFZKHaLIv7vYvUye4NZSbx/HyMMizpau+COtsRCoJNEHmrVLrScW53aSL44zQKr8w+KhSAyOGXKHt60Xm/LdsrMj3YTgPU84MZJ8zxlU1nvMPZAZo1jDrDWQVuX/xC5W2FhWp7vry2CLtcsc7RXsZPl/nvI8WqpELKF5FeifVMYiIJXZtEY7F/30bjnTS1rNFKJARpi9wrS2lW0h2Z9XAlr2YRWGP8bxFaHYTW/bRa9mRoFUUqiJCKUhScnMJlGm6rFG7pVA2lgwidqp2F2yPuFXAuyxOQI8oYl+RUkCMczTPL7Buum6I/c2nqWpgDnLhjghzRR9tEP2YNDr0gsC2zyhPMBVblG3adnBv4IvAl4A2TwrJrc+H0HvAtY9lMdCyh05TPdnSQif6fHxp4p2WVoQQps4amsYcowPdVkIkBHcMyxBxN3fTMqtm0MHcDZKImofNyvKyJwwrx2WTeuChazp19zNmNAx84/a5oMvMnH9JSsk8dV0RFK8RI5fUX3vaX7W+zBC/bbvhilkSnppLlg+JwJccO/O9LDEnmGvuLWYG8PH2InPchB+Vi1fYVZ9rGanklXnL1Eq5qacNAKAT13TdM4xvDYBtEdyVNOVD++0NbAXWiiPakdaR565HyFLmyLcd4MKVjwTYvi0KQPmC2tVqOthdA2ygWEYq3kUFvcUe53G+SQ8/PdfFX5wprEZalokg+MlFsYu5HFopNsy7f4b8+HCl0lnz1e3gKLBAFtMcbhXkt51IQ6Kso0tVVUfR62jU6buR1VWXpMUxatCwHE/jr5PyUDEvsTH5/5Ke7hALmPilcfzPsZiXfAJzzU9AdBJPL9vAZHdjlyZu006PpPGGYm/cmzjGRSiyzLWH5hQQ+VxsWPo1cYaorlyfpJMXnpx5d5095HtFHDIVp+VKN8BU6C30+ilBZpBX991TVafNfUdpUCiApTHfCFiq/cg7we4XBYE22Mn8kp4iDGExAO9LUqWuUKH0oUZjf0cA82v9+oPowGVkTX1qa4qi9xJKrLq+GOIL+5EPQqz7ZpMexYKd4HL2nYCJJpdoNpN7fwbGQybLNNtZ0Q6HSKYkHHYYkCAu2QT9JQDWLNm/hxWmGLXjvFsiihaqVjrZaShXXCq4LjH5i0FJcRj8paMFD6KC+pSwz+slAS1lldEDfUtYY/SSgpdxg9BOAlnKL0Sf/lnKH0Sf+lnKX0Sf9lvI5o0/4LeU+o0/2LeUBo0/0LeURrg/ZM8ame4glzI3CF7OXvGr7WZkOt4GwxSikc5pvgzCYnMwXzexS1cyKVSrLlam5L0XMSXqlmRyeDXqxL44YWHamzpZx9z1ym/FeEL5NoeLX/iu/47HFsdjbnQs47oRVe4OBvK1FYapZoQnSjSt8aTc8jqhl90e9ycSZ+D5cs0xnUvC45mk0OB/5kyejaBj0nwh2eEKHIU/mdJ1EjP0BGGAmTtAiAAA=

H4sIAH80gmQA/12OzUrDUBCFz530x5hi3bjqA4gIWSgEXLhJKZTaRaD4AOPtxGInTbg3Kt35Br5yb2wXxcVwmDMz55vJckH0AUPoI743wHOooxpkJgpKp76HFxgkDTuu/CRnL7Oqafcr62rVOe/WKu5686dTZe/HYVN2bcHt5qpxUvLbq9PfEBnhAqMMwG3HIMITRZQjMhl6wesjB9GjGQbmAA/AzxIExLat3c0ZsugeubQdKvEirDpq2G75Xe7KMJHv2m3T6sumVb0WTf9fJsH+VMEBq9BUEAIBAAA=

H4sIAP00gmQA/y3U11JiARRE0cttMecsmLMYAAGzmEURc845fMh80nzgWNP7ba/zeqo6XiqG4Z+GMFBQCv6G2eAoyEYU5MIgyIeRSD4SwREc4hALC5fhMhzFUVyOy3EFrsCVuBJX4SpcjatxDa7BtbgW1+E6XI/rcQNuwI24ETfhJtyMm3ELbsGtuBW34TbcjttxB+7AnbgTd+EuHMMxHP/1768i3dzj3HtwN+7FPbgP9+J+3IcHcD8exAN4CA/iYTyER/AwHsUjeAyP4nE8hifwOE7gCTyJE3gKT+JpPIVn8DRO4hmcwkmcxik8i9M4g2dxFmdwDmfxHM7heTyHF/A8XsQLeAkv4mW8hFfwMl7FKziPV/EazuN1vIY38DrexBt4C2/ibbyFd/A23sU7uIB38R4u4H28h4t4Hx/gIi7hA3z4u2dh8DtHgX50Hf0f39pxfOnb8akvx4c+He/6cLzp3fGqN8eLXh3PenE86dnxqCfHgx4d93pw3Onecas7x41uHde6cVzpx3GpK8eFLh3nunCc6dxxqjPHiU4dx9p2HOnYcagjR0mHjgPtO4o6cOyr5NhT0VHQiWNXBceOFhzbWnRsac+xqQ3HhnKOdY068hpwrGndsaIRx7KGHUvKOxa161hQzDGvHkdOc46sNh0ZZR2zyjjSmnWklHYklXLMKOmY1oxjUtOOhCYdE0o4xjXhGNO4Y1RjjhGtOYa14hjSsmNQQ44BDTr6tOToVZ+jR72Obs074up2xBR3dGkrGvwDzdfYoYwHAAA=

zv6fc8ePrk8OkxOsqE0TLUtyxvioiuetnBw6dHAhWPT2TeL54GN5wenGgNAkZKf1At5zZy8p5ZDe0W2xxaNy3ZFhYdWCPvzmorxydHxYO9k0fFA+N2EOi3v6eo253pwUW6rI5xpWdatVeXf1x6+uCxlvD06PZp8c5R8f5j3DKh2/DxIdWXis+KJVo1Hka/G29CyzjbhukPenq4KzQenh4/IqGBniVZnuo8yEDdob517Q3rjyfUaS+9LTPene9u5e9elH3i3ZNijBeGq29R3pLuHrnOOBjTEBlQIG/M9L1BfX8Q48CSbhFTg0pk+wAbhdxM72AaAk+7H7a7orPvjM1oDG37tnT/cvdjhvsLZNsovQIt2X5zyd6VQYcDLctunofyYNxVGxf161rztj4FMaWiPl/tx3V1agI9NbKPraGq5UrFXitfvBIfxvjN7WWrojZytfpt81Y/+55oqbPauU1f9Glr562rnAHsdfldqqum/wMdwgfWqiIAAA==��4SuVUj6O8u6HSM3K7HO+6rrsBsdJzsOpFJjhp/YdwcJz7aobGJBUBgNeBAV4KM+bTVZScQUdnpoICGQNzqmMYoZ31MAZJyKe0hsiQVzLavbwCaFaPylGWLpRsKMT+1GHZ7P8sH/3v/7vyDP/2P8P3qfjulyLP9bEG71SuOhb4OjF0O3bMBI01mv5oSXLbDE98f8BvKihyiyvAQA=

Some features are as follows:

Most of them begin with H4sIAP00gmQA/ (but there are exceptions, i.e. 4SuVUj6O8u6HSM3K7HO+6rrsBsdJzsOpFJjhp/YdwcJz7aobGJBUBgNeBAV4KM+bTVZScQUdnpoICGQNzqmMYoZ31MAZJyKe0hsiQVzLavbwCaFaPylGWLpRsKMT+1GHZ7P8sH/3v/7vyDP/2P8P3qfjulyLP9bEG71SuOhb4OjF0O3bMBI01mv5oSXLbDE98f8BvKihyiyvAQA).
They have high information entropy, indicating compression. With counting the number of occurrences of 64 characters, the information entropy of each of them is about 5.9 (the upper bound is 6).
They are encoded in UTF16LE instead of ASCII and stored in memory. So I believe they are encrypted string (May be not).

Hope to receive your suggestions. Best wish for you :)

This is the compressed luajit bytecode

66hh commented 1 year ago

I found some interesting UTF16LE encoded strings in dumped memory, but I have no idea to decrypt them. I would be very grateful if you could provide some advice (I have poor background in cryptography). Three samples:

H4sIAP40gmQA/6VaTW/cyHYtFtn87A+JrZZk+XOssWW7PdbYPdMYAlEAta2Z0Ys0GtjWixYBGu1uqsVxi1S6KY2NLNxZBu8PZJlVECCLAFlll3WC9wOyy0/IKkCAbN65xSKbTckzz4kAgazDe6uKVfeee2+xr+/9hvN/KzNFY0/Z75S2ojBP4YrHVbahaqyjqHxLYSzBdYkbEi8VcEviJpvvx5G4LfGKxKsSLxfwBYnXCrgr8cUCviTxegFflnijgK9KfKUwzzWJXyvgNyR+vYDfkvjNAn5H4rcL+F2Jf1bAP5f4emE970v83kfkNwr4Q4k/KOBNiT+S+BcSfyLxx4X1SfFNYF+yGlPYEVenLmei3UG/fwZsuesPgrj3ZuTvhkH828D/ebkbnPaG/mnv3ci/8EdxcOauv4nDbgrcPA7CwfOTYDTonMdxFP55EJ9snw+CaLELsVSqvD6MutB1usMIl8NR7310Hm8SOnkbjEab65P+OBqNugN/0u9HYdwLQn+8SRM4i8Y5wefZM4JeEbQb+6eL6DdrLKeNTPirS+P14ngcvDmP/bB36m+ux+/ibgaNLpa6AHLtRlG/kg6xKZ9kwpv9uRm+Gfu9t/7xsd+P69DJNZ/9iuYkHvvhMD7BDCFB7zSPNIr6tAZZ46Z8Gr8/80V3dEOLswCp1+l9Tqgs8ZskfDaOhmN/MtlcF5vfHUX9t7XEEOj22bwMLV7/fCw2ehNPgnASDONU9+tyovj1J2l9JbW++iStltRqfZLWM6n17JO0ntYzy98lQHby9OEf00kVq51293Fx0YqjuDcS7TpZ5ax5++Oabja11/67eJH00keLeS3nAg723UE1E68MoxN/dOaPyUxSqUOGqKAyw0PQcDmRiqJ4KmeuxkAcmiCO1W4UPh8F/bf7vXd7NE4nDhvbg4HA9oIJHM0fz1HCnzBFZZyV8r2mNLT60j+NLvyPK/+ryhSduexr0q6D6GYBjStJbyrmqDEPc6wxjR2V+HRDK+Gq4KqzZknB3EuKpxiSDBem1Fdyb07bioU+bJCnwzzVxH9ZTQPhkVKHbAXPq9CvKQlWzenrc/p4K6lXkvjCHJ6Q8GJGwtWxf4x1PzncXeuDL2J/PwjFmu785Xlwth+VfXE9qNLu/dgb905dusvYzggGla6Q2R2kPchdkT0siOv3YqelKLrrnvQG4oFLBP9zL+6fdMNovDJrTfwRmMsfXA4K9YkfC91XZ+Mg9isw7rgX9v364W6CvPLj/SEGm5xEP2M2/14io7rLdr7CotHmJVdFXjk2U8WiaFioEmuqtFmqMsP0KzCjgFnAbIaF5ulCe2KxyTjKMI5KZsCJPDaT14R8G9mKpy6qnuqqs/6W8LyRy0Dqco6rEr+Wy0Dy+HWJr0n8JvBbrK0ik9DuwEA/0zpwpm1FgcwNRgZQ2Q6xvnE0XjhEFH6/Ew6xrQ6xdHQsXbYRYXHJv6LTsyj0QzBKTypViQkueqNz38VdhyLOb6lVIZzC3Tw7NFKhbcSOH/C4lvBbgHBUCFkFxqsLQaG7C+HrZwgn3fOg2xucBpNJEIXd6MwPjcPdqkgIdsLz0zknXuoNBoe7wsmFQCXlkEvEURtiXgdvfsIccmFoeejHQizLOZxun9r5GHcpM5iPolXY7XY/Di78jPrcSSpOwy/EvWF6f32mS4uVwn9Fpqwzp60wwWKJiXHla7WE7VXZn2qK6mkarlyYE20xcnP88cxPMy9cozVLPImm8To4oyQo86cl8YhcndIlf/w7QYSL7Iv/LxG2QYQzHRM6ICrVVj3pIzNys0BiTk62rLThS55ahb/UxAseKeYvyCxki7D2I1nM4W53N3wbhMPuYUjbulpA94AtfO+Po+/G0flZ3prKSHaGQ1CYQEAvM+bbP7g28cOEzqiDl0D9SVwRwMuz/tK7IHwX9ND9T4E/OY8WszYaORv7I3nNFimSw7DwjIl3+xeTYUW/YH+DlZN5O956S5hIupIlETI8EYZ0pSpz8pm8AXmNNcGGCXsxJmQUGzKa7MOYNsWuU32WhhxNhpZkLOp/C7vRRk1G9UCyI1UKtrzCqQ9l6vEFZQvs1+bog7vco/qOow+OuozXgS0Ba2AHl2ERCFVcVZrQ3eIreIYx+DXIruZk16SsKa0OY0g9jxPG2ZGKkIv+k/vKtM2vQ7fCXbChx29wT0MfpVU8h7XqsNrSTVxhtaVbrKnDajmsNhvvNkv7n2F3rsA+m3uHy2PexZgruTHX5ZifZ2O6Kr3vPVofvIvCEt37nNYreRfsK60x35D9PuCJ7EMp+4i3tSbm9lijOZC1WAfw+qXD3YT4QZ1ExBY5wozXVyh0vg7ikb8NFgbl++OqsHUiiDVw4e6Eetnzj+NOr//2DP+zTOL/ENKLRdBcfZHPD3/RlwoOVPCbnKc5wYQcNfGkLE/IMf9c7LiKt4PJD9H4tJckOfXuXNM5AYHsDspdecVyEaVk/rwipF77PcHo+9EANWsXQe04GF6dhOVTqFnmVJZ0DiJyEu2M4X8ta8uI669Vig6L7HGSFzKRFyb3irgHOSTOr1Sm2T1fwb1MhYjOkSIhJZIGaArjVHiik89Nm3hOdOwROXDo8yocuSLHq4nxZnlrqpOkWYnMQpa3LtKe/SiNoiFNT0SxF6jqKwDwnnsXVoyso2hcl2v2K3b4Gnbthyh+hWFeis5e9sYzSl5IQyNW3RrjyfwO7B8UTGJJzrDTm/gUzmuy/bo3/CeNIb9fUQ49GdLbnJZRxXIqbObnSPPBtchQwSuIpJrCUn+ex7nkGkNsRbIlFheRFX02wSdtzWZuCXIa146M+1PPctg3qmFVUXcdWY2pa2MeVpl1LA59i7Ut9G9VLc+uCWzLqqge/l0b22QtWm0Hzx3X6VjIPK0FtW2B/6wlyDvMdVToYD6ijxKwitp0uMA8krUxT9u0XQfZs71su2WTdWz0YzesHUNVXxr/8aGBd1rWmOaVHNYoldhDcOO+hqhvok+zZIr5W4aFOVlNG+tiqsqB9j8faG1q2EWssWA4MgUHG+iPY1scO7mUt3UpL93HVix+hwwvzXBNWMxcZtcfAd8NwZJ93xhGdfR7iJ5e9OLe6zfdfOLmBGe9YDyRIxNypdWkZyBXmF4tDEbR2D89i987yAKRl5joP6UI/g82g7M8Vf9ZeQyH9FSK8Ng5Dc4Gi0GxrLpIBD1VVb0SVkjHbuolvW3ASQ3D6Kgl1YXFuHDgI9Uu6JhCp61DVjf0jqplsonlWDnLeQXLsXOWc19ajpOznErBcspqgi0CK6sbjstmVlORVkN4Q+L1Ar4i8WWJX5P4msRXgSPKWjeA2znrI9mbQja1vhm2qq45zDAdEJbDp026lpXpTA5rYXErsfZbsHa0He64ZeSczm3Hq9wxOxhn21J420bEt7m05ru2V15QNyrrzKt+bt2vVCsdG4Rp11XPqVtbzj0bFo/7ZZPuE2v/R2ntHNZuF6wd8zVvmmLNhbWX56y9DUbwoOfSnmv3NU/fwH5jP4wHRkfTVJEZ6benbR396Dd1z3jImibeUcc76pi3znWXbES/q3vmI7ZhrTPX1th9y7Y6OuatN1nbeIz+vjBceF7HwH4a93RPfyLxTeClDE/G+VKM09FB7HqpMLYixiYvbZAPTPZ6k/hV8GYEe78O5yGa/NEf9+GNoqR8FY/na8yGFBIIeXE+TF6qNAsFZKHaLIv7vYvUye4NZSbx/HyMMizpau+COtsRCoJNEHmrVLrScW53aSL44zQKr8w+KhSAyOGXKHt60Xm/LdsrMj3YTgPU84MZJ8zxlU1nvMPZAZo1jDrDWQVuX/xC5W2FhWp7vry2CLtcsc7RXsZPl/nvI8WqpELKF5FeifVMYiIJXZtEY7F/30bjnTS1rNFKJARpi9wrS2lW0h2Z9XAlr2YRWGP8bxFaHYTW/bRa9mRoFUUqiJCKUhScnMJlGm6rFG7pVA2lgwidqp2F2yPuFXAuyxOQI8oYl+RUkCMczTPL7Buum6I/c2nqWpgDnLhjghzRR9tEP2YNDr0gsC2zyhPMBVblG3adnBv4IvAl4A2TwrJrc+H0HvAtY9lMdCyh05TPdnSQif6fHxp4p2WVoQQps4amsYcowPdVkIkBHcMyxBxN3fTMqtm0MHcDZKImofNyvKyJwwrx2WTeuChazp19zNmNAx84/a5oMvMnH9JSsk8dV0RFK8RI5fUX3vaX7W+zBC/bbvhilkSnppLlg+JwJccO/O9LDEnmGvuLWYG8PH2InPchB+Vi1fYVZ9rGanklXnL1Eq5qacNAKAT13TdM4xvDYBtEdyVNOVD++0NbAXWiiPakdaR565HyFLmyLcd4MKVjwTYvi0KQPmC2tVqOthdA2ygWEYq3kUFvcUe53G+SQ8/PdfFX5wprEZalokg+MlFsYu5HFopNsy7f4b8+HCl0lnz1e3gKLBAFtMcbhXkt51IQ6Kso0tVVUfR62jU6buR1VWXpMUxatCwHE/jr5PyUDEvsTH5/5Ke7hALmPilcfzPsZiXfAJzzU9AdBJPL9vAZHdjlyZu006PpPGGYm/cmzjGRSiyzLWH5hQQ+VxsWPo1cYaorlyfpJMXnpx5d5095HtFHDIVp+VKN8BU6C30+ilBZpBX991TVafNfUdpUCiApTHfCFiq/cg7we4XBYE22Mn8kp4iDGExAO9LUqWuUKH0oUZjf0cA82v9+oPowGVkTX1qa4qi9xJKrLq+GOIL+5EPQqz7ZpMexYKd4HL2nYCJJpdoNpN7fwbGQybLNNtZ0Q6HSKYkHHYYkCAu2QT9JQDWLNm/hxWmGLXjvFsiihaqVjrZaShXXCq4LjH5i0FJcRj8paMFD6KC+pSwz+slAS1lldEDfUtYY/SSgpdxg9BOAlnKL0Sf/lnKH0Sf+lnKX0Sf9lvI5o0/4LeU+o0/2LeUBo0/0LeURrg/ZM8ame4glzI3CF7OXvGr7WZkOt4GwxSikc5pvgzCYnMwXzexS1cyKVSrLlam5L0XMSXqlmRyeDXqxL44YWHamzpZx9z1ym/FeEL5NoeLX/iu/47HFsdjbnQs47oRVe4OBvK1FYapZoQnSjSt8aTc8jqhl90e9ycSZ+D5cs0xnUvC45mk0OB/5kyejaBj0nwh2eEKHIU/mdJ1EjP0BGGAmTtAiAAA=

H4sIAH80gmQA/12OzUrDUBCFz530x5hi3bjqA4gIWSgEXLhJKZTaRaD4AOPtxGInTbg3Kt35Br5yb2wXxcVwmDMz55vJckH0AUPoI743wHOooxpkJgpKp76HFxgkDTuu/CRnL7Oqafcr62rVOe/WKu5686dTZe/HYVN2bcHt5qpxUvLbq9PfEBnhAqMMwG3HIMITRZQjMhl6wesjB9GjGQbmAA/AzxIExLat3c0ZsugeubQdKvEirDpq2G75Xe7KMJHv2m3T6sumVb0WTf9fJsH+VMEBq9BUEAIBAAA=

H4sIAP00gmQA/y3U11JiARRE0cttMecsmLMYAAGzmEURc845fMh80nzgWNP7ba/zeqo6XiqG4Z+GMFBQCv6G2eAoyEYU5MIgyIeRSD4SwREc4hALC5fhMhzFUVyOy3EFrsCVuBJX4SpcjatxDa7BtbgW1+E6XI/rcQNuwI24ETfhJtyMm3ELbsGtuBW34TbcjttxB+7AnbgTd+EuHMMxHP/1768i3dzj3HtwN+7FPbgP9+J+3IcHcD8exAN4CA/iYTyER/AwHsUjeAyP4nE8hifwOE7gCTyJE3gKT+JpPIVn8DRO4hmcwkmcxik8i9M4g2dxFmdwDmfxHM7heTyHF/A8XsQLeAkv4mW8hFfwMl7FKziPV/EazuN1vIY38DrexBt4C2/ibbyFd/A23sU7uIB38R4u4H28h4t4Hx/gIi7hA3z4u2dh8DtHgX50Hf0f39pxfOnb8akvx4c+He/6cLzp3fGqN8eLXh3PenE86dnxqCfHgx4d93pw3Onecas7x41uHde6cVzpx3GpK8eFLh3nunCc6dxxqjPHiU4dx9p2HOnYcagjR0mHjgPtO4o6cOyr5NhT0VHQiWNXBceOFhzbWnRsac+xqQ3HhnKOdY068hpwrGndsaIRx7KGHUvKOxa161hQzDGvHkdOc46sNh0ZZR2zyjjSmnWklHYklXLMKOmY1oxjUtOOhCYdE0o4xjXhGNO4Y1RjjhGtOYa14hjSsmNQQ44BDTr6tOToVZ+jR72Obs074up2xBR3dGkrGvwDzdfYoYwHAAA=

zv6fc8ePrk8OkxOsqE0TLUtyxvioiuetnBw6dHAhWPT2TeL54GN5wenGgNAkZKf1At5zZy8p5ZDe0W2xxaNy3ZFhYdWCPvzmorxydHxYO9k0fFA+N2EOi3v6eo253pwUW6rI5xpWdatVeXf1x6+uCxlvD06PZp8c5R8f5j3DKh2/DxIdWXis+KJVo1Hka/G29CyzjbhukPenq4KzQenh4/IqGBniVZnuo8yEDdob517Q3rjyfUaS+9LTPene9u5e9elH3i3ZNijBeGq29R3pLuHrnOOBjTEBlQIG/M9L1BfX8Q48CSbhFTg0pk+wAbhdxM72AaAk+7H7a7orPvjM1oDG37tnT/cvdjhvsLZNsovQIt2X5zyd6VQYcDLctunofyYNxVGxf161rztj4FMaWiPl/tx3V1agI9NbKPraGq5UrFXitfvBIfxvjN7WWrojZytfpt81Y/+55oqbPauU1f9Glr562rnAHsdfldqqum/wMdwgfWqiIAAA==��4SuVUj6O8u6HSM3K7HO+6rrsBsdJzsOpFJjhp/YdwcJz7aobGJBUBgNeBAV4KM+bTVZScQUdnpoICGQNzqmMYoZ31MAZJyKe0hsiQVzLavbwCaFaPylGWLpRsKMT+1GHZ7P8sH/3v/7vyDP/2P8P3qfjulyLP9bEG71SuOhb4OjF0O3bMBI01mv5oSXLbDE98f8BvKihyiyvAQA=

Some features are as follows:

Most of them begin with H4sIAP00gmQA/ (but there are exceptions, i.e. 4SuVUj6O8u6HSM3K7HO+6rrsBsdJzsOpFJjhp/YdwcJz7aobGJBUBgNeBAV4KM+bTVZScQUdnpoICGQNzqmMYoZ31MAZJyKe0hsiQVzLavbwCaFaPylGWLpRsKMT+1GHZ7P8sH/3v/7vyDP/2P8P3qfjulyLP9bEG71SuOhb4OjF0O3bMBI01mv5oSXLbDE98f8BvKihyiyvAQA).
They have high information entropy, indicating compression. With counting the number of occurrences of 64 characters, the information entropy of each of them is about 5.9 (the upper bound is 6).
They are encoded in UTF16LE instead of ASCII and stored in memory. So I believe they are encrypted string (May be not).

Hope to receive your suggestions. Best wish for you :)

H4sIA is the header of Base64Gzip

66hh commented 1 year ago

FN3TSQ5IY2$VH}$5R9P29 4

SunsetMkt commented 1 year ago

This is the script I used dump.txt

I've noticed that the libil2cpp.so needs to be dumped, too. Instruction Here

66hh commented 1 year ago

This is the decompiled code lua.txt

Leundo commented 1 year ago

Thanks! It is Helpful! Now theoretically we can extract most of the lua scripts without decrypting excel2json - using pattern matching to extract luajit in dumped memory. The following is the lua list I found (running in armv7, at a543a000-a5fec000[rw-p]):

Offset  Length  Type    String
00098708    2a  A   @modules/configs/excel2json/lua_guide_step
0009fd70    2b  A   @modules/configs/excel2json/lua_app_include
000c0d28    31  A   @modules/configs/excel2json/lua_talent_cube_shape
000d0388    2e  A   @modules/configs/excel2json/lua_skill_eff_desc
000e0d20    30  A   @modules/configs/excel2json/lua_equip_break_cost
000e1868    2b  A   @modules/configs/excel2json/lua_task_season
000ebea0    2e  A   @modules/configs/excel2json/lua_skill_behavior
000ee648    2c  A   @modules/configs/excel2json/lua_store_charge
000f11b8    2d  A   @modules/configs/excel2json/lua_battle_dialog
000fb8e8    2b  A   @modules/configs/excel2json/lua_store_goods
000fdee0    33  A   @modules/configs/excel2json/lua_activity119_episode
000fee08    34  A   @modules/configs/excel2json/lua_character_motion_cut
000ff5d0    29  A   @modules/configs/excel2json/lua_open_lang
000ffd58    36  A   @modules/configs/excel2json/lua_handbook_story_chapter
0010e0c0    31  A   @modules/configs/excel2json/lua_explore_item_type
0011d888    2e  A   @modules/configs/excel2json/lua_skill_bufftype
0011e918    34  A   @modules/configs/excel2json/lua_block_resource_style
0011f978    34  A   @modules/configs/excel2json/lua_talent_effectiveness
00122b98    28  A   @modules/configs/excel2json/lua_backpack
00123580    33  A   @modules/configs/excel2json/lua_activity109_episode
001242d8    34  A   @modules/configs/excel2json/lua_character_battle_tag
0012c900    25  A   @modules/configs/excel2json/lua_const
0012f168    32  A   @modules/configs/excel2json/lua_handbook_character
00130d88    38  A   @modules/configs/excel2json/lua_season_episode_difficult
001319e8    31  A   @modules/configs/excel2json/lua_room_sources_type
00132448    2d  A   @modules/configs/excel2json/lua_weekwalk_rule
001416f0    33  A   @modules/configs/excel2json/lua_chapter_map_element
00142fb8    2a  A   @modules/configs/excel2json/lua_block_task
001476e8    36  A   @modules/configs/excel2json/lua_monster_skill_template
001518f0    2d  A   @modules/configs/excel2json/lua_special_block
00152520    2f  A   @modules/configs/excel2json/lua_production_part
00152f28    30  A   @modules/configs/excel2json/lua_push_box_episode
00160158    2f  A   @modules/configs/excel2json/lua_fight_technique
00162870    2e  A   @modules/configs/excel2json/lua_handbook_equip
00199388    24  A   @modules/configs/excel2json/lua_rule
001b9d70    2f  A   @modules/configs/excel2json/lua_language_server
002016b8    2e  A   @modules/configs/excel2json/lua_season_episode
002027e8    43  A   @modules/configs/excel2json/lua_chapter_puzzle_changecolor_interact
00212eb0    32  A   @modules/configs/excel2json/lua_activity104_retail
0021c5e0    2c  A   @modules/configs/excel2json/lua_monster_skin
0021d678    29  A   @modules/configs/excel2json/lua_storyskip
0021e180    2b  A   @modules/configs/excel2json/lua_equip_const
0021ed70    30  A   @modules/configs/excel2json/lua_item_specialitem
0021f948    30  A   @modules/configs/excel2json/lua_task_achievement
00221470    30  A   @modules/configs/excel2json/lua_activity106_task
00227490    2f  A   @modules/configs/excel2json/lua_character_voice
0022d628    2d  A   @modules/configs/excel2json/lua_weekwalk_type
0023def0    35  A   @modules/configs/excel2json/lua_fight_die_act_enemyus
003c6d08    2a  A   @modules/configs/excel2json/lua_skill_buff
003c8fd8    2a  A   @modules/configs/excel2json/lua_guide_mask
003c9f38    2f  A   @modules/configs/excel2json/lua_activity109_map
00470a30    2b  A   @modules/configs/excel2json/lua_fight_audio
0047cb60    32  A   @modules/configs/excel2json/lua_item_category_show
00482a28    31  A   @modules/configs/excel2json/lua_instruction_level
0048bea8    24  A   @modules/configs/excel2json/lua_jump
0048fab0    2e  A   @modules/configs/excel2json/lua_adventure_task
004904e8    2f  A   @modules/configs/excel2json/lua_activity108_map
004a0728    2c  A   @modules/configs/excel2json/lua_loading_text
004a1680    30  A   @modules/configs/excel2json/lua_activity119_task
004a26c0    2b  A   @modules/configs/excel2json/lua_fight_voice
004a6230    2b  A   @modules/configs/excel2json/lua_task_weekly
004a7f98    2d  A   @modules/configs/excel2json/lua_sign_in_bonus
004b5b10    2e  A   @modules/configs/excel2json/lua_character_rank
004b8a20    30  A   @modules/configs/excel2json/lua_activity113_task
004b9320    2d  A   @modules/configs/excel2json/lua_explore_scene
004bce68    3c  A   @modules/configs/excel2json/lua_room_character_dialog_select
004bee20    34  A   @modules/configs/excel2json/lua_fight_transition_act
004bf900    3a  A   @modules/configs/excel2json/lua_fight_stacked_buff_combine
004c1ba8    2f  A   @modules/configs/excel2json/lua_activity_center
004c2598    31  A   @modules/configs/excel2json/lua_activity108_event
004c30c0    35  A   @modules/configs/excel2json/lua_chapter_puzzle_square
004c52b8    28  A   @modules/configs/excel2json/lua_currency
004d10a8    34  A   @modules/configs/excel2json/lua_chapter_map_fragment
004d64b8    27  A   @modules/configs/excel2json/lua_bp_task
004d8270    2b  A   @modules/configs/excel2json/lua_main_banner
004dd348    2d  A   @modules/configs/excel2json/lua_talent_scheme
004e2750    2a  A   @modules/configs/excel2json/lua_friendless
004e3658    2f  A   @modules/configs/excel2json/lua_explore_element
004e9048    33  A   @modules/configs/excel2json/lua_skill_passive_level
004ec2f8    2b  A   @modules/configs/excel2json/lua_activity105
004ed0a0    2e  A   @modules/configs/excel2json/lua_character_grow
004fe0b0    2f  A   @modules/configs/excel2json/lua_character_level
0050fdc8    24  A   @modules/configs/excel2json/lua_skin
00517ad0    36  A   @modules/configs/excel2json/lua_activity104_equip_attr
0051a190    31  A   @modules/configs/excel2json/lua_subclass_priority
0051b070    26  A   @modules/configs/excel2json/lua_bp_des
0051bc08    30  A   @modules/configs/excel2json/lua_activity109_task
0051cc48    27  A   @modules/configs/excel2json/lua_herocut
0051d688    37  A   @modules/configs/excel2json/lua_chapter_puzzle_question
0051e3d0    25  A   @modules/configs/excel2json/lua_store
0051ee50    33  A   @modules/configs/excel2json/lua_activity104_episode
0051fd78    30  A   @modules/configs/excel2json/lua_formula_showtype
00559538    2c  A   @modules/configs/excel2json/lua_explore_item
0055b4f0    28  A   @modules/configs/excel2json/lua_weekwalk
0055e440    2c  A   @modules/configs/excel2json/lua_weather_week
0055f3d8    2d  A   @modules/configs/excel2json/lua_weather_month
0055fd78    2d  A   @modules/configs/excel2json/lua_equip_chapter
00575988    28  A   @modules/configs/excel2json/lua_ui_audio
0059a3d8    2c  A   @modules/configs/excel2json/lua_skill_effect
0059c4c8    32  A   @modules/configs/excel2json/lua_skin_monster_scale
0059dc18    22  A   @modules/configs/excel2json/lua_bp
0059f940    2e  A   @modules/configs/excel2json/lua_weekwalk_bonus
007e3dc0    2f  A   @modules/configs/excel2json/lua_weekwalk_branch
007e48d0    2d  A   @modules/configs/excel2json/lua_weekwalk_buff
007e73a8    32  A   @modules/configs/excel2json/lua_activity108_dialog
007e8270    2b  A   @modules/configs/excel2json/lua_summon_pool
007f2010    30  A   @modules/configs/excel2json/lua_story_role_audio
007f2880    30  A   @modules/configs/excel2json/lua_activity112_task
007f3440    2d  A   @modules/configs/excel2json/lua_push_box_task
008029e0    32  A   @modules/configs/excel2json/lua_block_random_event
00804680    31  A   @modules/configs/excel2json/lua_weekwalk_question
00805870    2d  A   @modules/configs/excel2json/lua_weekwalk_pray
008061d0    30  A   @modules/configs/excel2json/lua_activity108_rule
00806c58    2e  A   @modules/configs/excel2json/lua_weekwalk_level
00807c10    32  A   @modules/configs/excel2json/lua_weekwalk_buff_pool
0080b608    30  A   @modules/configs/excel2json/lua_weekwalk_element
008e4d88    30  A   @modules/configs/excel2json/lua_character_talent
008ec570    31  A   @modules/configs/excel2json/lua_activity104_const
008ed160    2b  A   @modules/configs/excel2json/lua_weather_day
008eda60    33  A   @modules/configs/excel2json/lua_sign_in_addup_bonus
00923500    27  A   @modules/configs/excel2json/lua_episode
00931f00    32  A   @modules/configs/excel2json/lua_hero_effectiveness
0093f748    2a  A   @modules/configs/excel2json/lua_task_guide
00942318    2f  A   @modules/configs/excel2json/lua_storydialogfade
00946150    2a  A   @modules/configs/excel2json/lua_messagebox
0095fda8    2a  A   @modules/configs/excel2json/lua_room_theme
00960b00    31  A   @modules/configs/excel2json/lua_instruction_topic
00966d60    30  A   @modules/configs/excel2json/lua_equip_break_attr
009689b8    28  A   @modules/configs/excel2json/lua_item_use
009696b8    2b  A   @modules/configs/excel2json/lua_block_style
0096b1d0    33  A   @modules/configs/excel2json/lua_monster_guide_focus
0096cf90    3a  A   @modules/configs/excel2json/lua_chapter_puzzle_changecolor
0097c150    27  A   @modules/configs/excel2json/lua_monster
0097e818    2c  A   @modules/configs/excel2json/lua_explore_unit
00987d80    24  A   @modules/configs/excel2json/lua_item
00a1eca8    2e  A   @modules/configs/excel2json/lua_character_data
00a204b0    2a  A   @modules/configs/excel2json/lua_hero_trial
00a23240    30  A   @modules/configs/excel2json/lua_equip_strengthen
00a245e0    25  A   @modules/configs/excel2json/lua_cloth
00a26858    3b  A   @modules/configs/excel2json/lua_activity109_interact_object
00a2ae00    28  A   @modules/configs/excel2json/lua_bg_audio
00a2cbc0    3a  A   @modules/configs/excel2json/lua_room_character_interaction
00a2ff50    2f  A   @modules/configs/excel2json/lua_block_bonus_map
00a83b18    2a  A   @modules/configs/excel2json/lua_role_audio
00a84590    31  A   @modules/configs/excel2json/lua_effect_with_audio
00abf4b0    25  A   @modules/configs/excel2json/lua_block
00ac3e78    33  A   @modules/configs/excel2json/lua_adventure_buff_pool
00ad5430    2b  A   @modules/configs/excel2json/lua_chapter_map

66hh commented 1 year ago

Thanks! It is Helpful! Now theoretically we can extract most of the lua scripts without decrypting excel2json - using pattern matching to extract luajit in dumped memory. The following is the lua list I found (running in armv7, at a543a000-a5fec000[rw-p]):

Offset    Length  Type    String
00098708  2a  A   @modules/configs/excel2json/lua_guide_step
0009fd70  2b  A   @modules/configs/excel2json/lua_app_include
000c0d28  31  A   @modules/configs/excel2json/lua_talent_cube_shape
000d0388  2e  A   @modules/configs/excel2json/lua_skill_eff_desc
000e0d20  30  A   @modules/configs/excel2json/lua_equip_break_cost
000e1868  2b  A   @modules/configs/excel2json/lua_task_season
000ebea0  2e  A   @modules/configs/excel2json/lua_skill_behavior
000ee648  2c  A   @modules/configs/excel2json/lua_store_charge
000f11b8  2d  A   @modules/configs/excel2json/lua_battle_dialog
000fb8e8  2b  A   @modules/configs/excel2json/lua_store_goods
000fdee0  33  A   @modules/configs/excel2json/lua_activity119_episode
000fee08  34  A   @modules/configs/excel2json/lua_character_motion_cut
000ff5d0  29  A   @modules/configs/excel2json/lua_open_lang
000ffd58  36  A   @modules/configs/excel2json/lua_handbook_story_chapter
0010e0c0  31  A   @modules/configs/excel2json/lua_explore_item_type
0011d888  2e  A   @modules/configs/excel2json/lua_skill_bufftype
0011e918  34  A   @modules/configs/excel2json/lua_block_resource_style
0011f978  34  A   @modules/configs/excel2json/lua_talent_effectiveness
00122b98  28  A   @modules/configs/excel2json/lua_backpack
00123580  33  A   @modules/configs/excel2json/lua_activity109_episode
001242d8  34  A   @modules/configs/excel2json/lua_character_battle_tag
0012c900  25  A   @modules/configs/excel2json/lua_const
0012f168  32  A   @modules/configs/excel2json/lua_handbook_character
00130d88  38  A   @modules/configs/excel2json/lua_season_episode_difficult
001319e8  31  A   @modules/configs/excel2json/lua_room_sources_type
00132448  2d  A   @modules/configs/excel2json/lua_weekwalk_rule
001416f0  33  A   @modules/configs/excel2json/lua_chapter_map_element
00142fb8  2a  A   @modules/configs/excel2json/lua_block_task
001476e8  36  A   @modules/configs/excel2json/lua_monster_skill_template
001518f0  2d  A   @modules/configs/excel2json/lua_special_block
00152520  2f  A   @modules/configs/excel2json/lua_production_part
00152f28  30  A   @modules/configs/excel2json/lua_push_box_episode
00160158  2f  A   @modules/configs/excel2json/lua_fight_technique
00162870  2e  A   @modules/configs/excel2json/lua_handbook_equip
00199388  24  A   @modules/configs/excel2json/lua_rule
001b9d70  2f  A   @modules/configs/excel2json/lua_language_server
002016b8  2e  A   @modules/configs/excel2json/lua_season_episode
002027e8  43  A   @modules/configs/excel2json/lua_chapter_puzzle_changecolor_interact
00212eb0  32  A   @modules/configs/excel2json/lua_activity104_retail
0021c5e0  2c  A   @modules/configs/excel2json/lua_monster_skin
0021d678  29  A   @modules/configs/excel2json/lua_storyskip
0021e180  2b  A   @modules/configs/excel2json/lua_equip_const
0021ed70  30  A   @modules/configs/excel2json/lua_item_specialitem
0021f948  30  A   @modules/configs/excel2json/lua_task_achievement
00221470  30  A   @modules/configs/excel2json/lua_activity106_task
00227490  2f  A   @modules/configs/excel2json/lua_character_voice
0022d628  2d  A   @modules/configs/excel2json/lua_weekwalk_type
0023def0  35  A   @modules/configs/excel2json/lua_fight_die_act_enemyus
003c6d08  2a  A   @modules/configs/excel2json/lua_skill_buff
003c8fd8  2a  A   @modules/configs/excel2json/lua_guide_mask
003c9f38  2f  A   @modules/configs/excel2json/lua_activity109_map
00470a30  2b  A   @modules/configs/excel2json/lua_fight_audio
0047cb60  32  A   @modules/configs/excel2json/lua_item_category_show
00482a28  31  A   @modules/configs/excel2json/lua_instruction_level
0048bea8  24  A   @modules/configs/excel2json/lua_jump
0048fab0  2e  A   @modules/configs/excel2json/lua_adventure_task
004904e8  2f  A   @modules/configs/excel2json/lua_activity108_map
004a0728  2c  A   @modules/configs/excel2json/lua_loading_text
004a1680  30  A   @modules/configs/excel2json/lua_activity119_task
004a26c0  2b  A   @modules/configs/excel2json/lua_fight_voice
004a6230  2b  A   @modules/configs/excel2json/lua_task_weekly
004a7f98  2d  A   @modules/configs/excel2json/lua_sign_in_bonus
004b5b10  2e  A   @modules/configs/excel2json/lua_character_rank
004b8a20  30  A   @modules/configs/excel2json/lua_activity113_task
004b9320  2d  A   @modules/configs/excel2json/lua_explore_scene
004bce68  3c  A   @modules/configs/excel2json/lua_room_character_dialog_select
004bee20  34  A   @modules/configs/excel2json/lua_fight_transition_act
004bf900  3a  A   @modules/configs/excel2json/lua_fight_stacked_buff_combine
004c1ba8  2f  A   @modules/configs/excel2json/lua_activity_center
004c2598  31  A   @modules/configs/excel2json/lua_activity108_event
004c30c0  35  A   @modules/configs/excel2json/lua_chapter_puzzle_square
004c52b8  28  A   @modules/configs/excel2json/lua_currency
004d10a8  34  A   @modules/configs/excel2json/lua_chapter_map_fragment
004d64b8  27  A   @modules/configs/excel2json/lua_bp_task
004d8270  2b  A   @modules/configs/excel2json/lua_main_banner
004dd348  2d  A   @modules/configs/excel2json/lua_talent_scheme
004e2750  2a  A   @modules/configs/excel2json/lua_friendless
004e3658  2f  A   @modules/configs/excel2json/lua_explore_element
004e9048  33  A   @modules/configs/excel2json/lua_skill_passive_level
004ec2f8  2b  A   @modules/configs/excel2json/lua_activity105
004ed0a0  2e  A   @modules/configs/excel2json/lua_character_grow
004fe0b0  2f  A   @modules/configs/excel2json/lua_character_level
0050fdc8  24  A   @modules/configs/excel2json/lua_skin
00517ad0  36  A   @modules/configs/excel2json/lua_activity104_equip_attr
0051a190  31  A   @modules/configs/excel2json/lua_subclass_priority
0051b070  26  A   @modules/configs/excel2json/lua_bp_des
0051bc08  30  A   @modules/configs/excel2json/lua_activity109_task
0051cc48  27  A   @modules/configs/excel2json/lua_herocut
0051d688  37  A   @modules/configs/excel2json/lua_chapter_puzzle_question
0051e3d0  25  A   @modules/configs/excel2json/lua_store
0051ee50  33  A   @modules/configs/excel2json/lua_activity104_episode
0051fd78  30  A   @modules/configs/excel2json/lua_formula_showtype
00559538  2c  A   @modules/configs/excel2json/lua_explore_item
0055b4f0  28  A   @modules/configs/excel2json/lua_weekwalk
0055e440  2c  A   @modules/configs/excel2json/lua_weather_week
0055f3d8  2d  A   @modules/configs/excel2json/lua_weather_month
0055fd78  2d  A   @modules/configs/excel2json/lua_equip_chapter
00575988  28  A   @modules/configs/excel2json/lua_ui_audio
0059a3d8  2c  A   @modules/configs/excel2json/lua_skill_effect
0059c4c8  32  A   @modules/configs/excel2json/lua_skin_monster_scale
0059dc18  22  A   @modules/configs/excel2json/lua_bp
0059f940  2e  A   @modules/configs/excel2json/lua_weekwalk_bonus
007e3dc0  2f  A   @modules/configs/excel2json/lua_weekwalk_branch
007e48d0  2d  A   @modules/configs/excel2json/lua_weekwalk_buff
007e73a8  32  A   @modules/configs/excel2json/lua_activity108_dialog
007e8270  2b  A   @modules/configs/excel2json/lua_summon_pool
007f2010  30  A   @modules/configs/excel2json/lua_story_role_audio
007f2880  30  A   @modules/configs/excel2json/lua_activity112_task
007f3440  2d  A   @modules/configs/excel2json/lua_push_box_task
008029e0  32  A   @modules/configs/excel2json/lua_block_random_event
00804680  31  A   @modules/configs/excel2json/lua_weekwalk_question
00805870  2d  A   @modules/configs/excel2json/lua_weekwalk_pray
008061d0  30  A   @modules/configs/excel2json/lua_activity108_rule
00806c58  2e  A   @modules/configs/excel2json/lua_weekwalk_level
00807c10  32  A   @modules/configs/excel2json/lua_weekwalk_buff_pool
0080b608  30  A   @modules/configs/excel2json/lua_weekwalk_element
008e4d88  30  A   @modules/configs/excel2json/lua_character_talent
008ec570  31  A   @modules/configs/excel2json/lua_activity104_const
008ed160  2b  A   @modules/configs/excel2json/lua_weather_day
008eda60  33  A   @modules/configs/excel2json/lua_sign_in_addup_bonus
00923500  27  A   @modules/configs/excel2json/lua_episode
00931f00  32  A   @modules/configs/excel2json/lua_hero_effectiveness
0093f748  2a  A   @modules/configs/excel2json/lua_task_guide
00942318  2f  A   @modules/configs/excel2json/lua_storydialogfade
00946150  2a  A   @modules/configs/excel2json/lua_messagebox
0095fda8  2a  A   @modules/configs/excel2json/lua_room_theme
00960b00  31  A   @modules/configs/excel2json/lua_instruction_topic
00966d60  30  A   @modules/configs/excel2json/lua_equip_break_attr
009689b8  28  A   @modules/configs/excel2json/lua_item_use
009696b8  2b  A   @modules/configs/excel2json/lua_block_style
0096b1d0  33  A   @modules/configs/excel2json/lua_monster_guide_focus
0096cf90  3a  A   @modules/configs/excel2json/lua_chapter_puzzle_changecolor
0097c150  27  A   @modules/configs/excel2json/lua_monster
0097e818  2c  A   @modules/configs/excel2json/lua_explore_unit
00987d80  24  A   @modules/configs/excel2json/lua_item
00a1eca8  2e  A   @modules/configs/excel2json/lua_character_data
00a204b0  2a  A   @modules/configs/excel2json/lua_hero_trial
00a23240  30  A   @modules/configs/excel2json/lua_equip_strengthen
00a245e0  25  A   @modules/configs/excel2json/lua_cloth
00a26858  3b  A   @modules/configs/excel2json/lua_activity109_interact_object
00a2ae00  28  A   @modules/configs/excel2json/lua_bg_audio
00a2cbc0  3a  A   @modules/configs/excel2json/lua_room_character_interaction
00a2ff50  2f  A   @modules/configs/excel2json/lua_block_bonus_map
00a83b18  2a  A   @modules/configs/excel2json/lua_role_audio
00a84590  31  A   @modules/configs/excel2json/lua_effect_with_audio
00abf4b0  25  A   @modules/configs/excel2json/lua_block
00ac3e78  33  A   @modules/configs/excel2json/lua_adventure_buff_pool
00ad5430  2b  A   @modules/configs/excel2json/lua_chapter_map

Excel2JSON appears to be encrypted using AES and has RSA signatures on the header

Leundo commented 1 year ago

Thank you both so much for your assistance XD. Have a good day.

saltyplum commented 1 year ago

Thanks! It is Helpful! Now theoretically we can extract most of the lua scripts without decrypting excel2json - using pattern matching to extract luajit in dumped memory. The following is the lua list I found (running in armv7, at a543a000-a5fec000[rw-p]):

Offset    Length  Type    String
00098708  2a  A   @modules/configs/excel2json/lua_guide_step
0009fd70  2b  A   @modules/configs/excel2json/lua_app_include
000c0d28  31  A   @modules/configs/excel2json/lua_talent_cube_shape
000d0388  2e  A   @modules/configs/excel2json/lua_skill_eff_desc
000e0d20  30  A   @modules/configs/excel2json/lua_equip_break_cost
000e1868  2b  A   @modules/configs/excel2json/lua_task_season
000ebea0  2e  A   @modules/configs/excel2json/lua_skill_behavior
000ee648  2c  A   @modules/configs/excel2json/lua_store_charge
000f11b8  2d  A   @modules/configs/excel2json/lua_battle_dialog
000fb8e8  2b  A   @modules/configs/excel2json/lua_store_goods
000fdee0  33  A   @modules/configs/excel2json/lua_activity119_episode
000fee08  34  A   @modules/configs/excel2json/lua_character_motion_cut
000ff5d0  29  A   @modules/configs/excel2json/lua_open_lang
000ffd58  36  A   @modules/configs/excel2json/lua_handbook_story_chapter
0010e0c0  31  A   @modules/configs/excel2json/lua_explore_item_type
0011d888  2e  A   @modules/configs/excel2json/lua_skill_bufftype
0011e918  34  A   @modules/configs/excel2json/lua_block_resource_style
0011f978  34  A   @modules/configs/excel2json/lua_talent_effectiveness
00122b98  28  A   @modules/configs/excel2json/lua_backpack
00123580  33  A   @modules/configs/excel2json/lua_activity109_episode
001242d8  34  A   @modules/configs/excel2json/lua_character_battle_tag
0012c900  25  A   @modules/configs/excel2json/lua_const
0012f168  32  A   @modules/configs/excel2json/lua_handbook_character
00130d88  38  A   @modules/configs/excel2json/lua_season_episode_difficult
001319e8  31  A   @modules/configs/excel2json/lua_room_sources_type
00132448  2d  A   @modules/configs/excel2json/lua_weekwalk_rule
001416f0  33  A   @modules/configs/excel2json/lua_chapter_map_element
00142fb8  2a  A   @modules/configs/excel2json/lua_block_task
001476e8  36  A   @modules/configs/excel2json/lua_monster_skill_template
001518f0  2d  A   @modules/configs/excel2json/lua_special_block
00152520  2f  A   @modules/configs/excel2json/lua_production_part
00152f28  30  A   @modules/configs/excel2json/lua_push_box_episode
00160158  2f  A   @modules/configs/excel2json/lua_fight_technique
00162870  2e  A   @modules/configs/excel2json/lua_handbook_equip
00199388  24  A   @modules/configs/excel2json/lua_rule
001b9d70  2f  A   @modules/configs/excel2json/lua_language_server
002016b8  2e  A   @modules/configs/excel2json/lua_season_episode
002027e8  43  A   @modules/configs/excel2json/lua_chapter_puzzle_changecolor_interact
00212eb0  32  A   @modules/configs/excel2json/lua_activity104_retail
0021c5e0  2c  A   @modules/configs/excel2json/lua_monster_skin
0021d678  29  A   @modules/configs/excel2json/lua_storyskip
0021e180  2b  A   @modules/configs/excel2json/lua_equip_const
0021ed70  30  A   @modules/configs/excel2json/lua_item_specialitem
0021f948  30  A   @modules/configs/excel2json/lua_task_achievement
00221470  30  A   @modules/configs/excel2json/lua_activity106_task
00227490  2f  A   @modules/configs/excel2json/lua_character_voice
0022d628  2d  A   @modules/configs/excel2json/lua_weekwalk_type
0023def0  35  A   @modules/configs/excel2json/lua_fight_die_act_enemyus
003c6d08  2a  A   @modules/configs/excel2json/lua_skill_buff
003c8fd8  2a  A   @modules/configs/excel2json/lua_guide_mask
003c9f38  2f  A   @modules/configs/excel2json/lua_activity109_map
00470a30  2b  A   @modules/configs/excel2json/lua_fight_audio
0047cb60  32  A   @modules/configs/excel2json/lua_item_category_show
00482a28  31  A   @modules/configs/excel2json/lua_instruction_level
0048bea8  24  A   @modules/configs/excel2json/lua_jump
0048fab0  2e  A   @modules/configs/excel2json/lua_adventure_task
004904e8  2f  A   @modules/configs/excel2json/lua_activity108_map
004a0728  2c  A   @modules/configs/excel2json/lua_loading_text
004a1680  30  A   @modules/configs/excel2json/lua_activity119_task
004a26c0  2b  A   @modules/configs/excel2json/lua_fight_voice
004a6230  2b  A   @modules/configs/excel2json/lua_task_weekly
004a7f98  2d  A   @modules/configs/excel2json/lua_sign_in_bonus
004b5b10  2e  A   @modules/configs/excel2json/lua_character_rank
004b8a20  30  A   @modules/configs/excel2json/lua_activity113_task
004b9320  2d  A   @modules/configs/excel2json/lua_explore_scene
004bce68  3c  A   @modules/configs/excel2json/lua_room_character_dialog_select
004bee20  34  A   @modules/configs/excel2json/lua_fight_transition_act
004bf900  3a  A   @modules/configs/excel2json/lua_fight_stacked_buff_combine
004c1ba8  2f  A   @modules/configs/excel2json/lua_activity_center
004c2598  31  A   @modules/configs/excel2json/lua_activity108_event
004c30c0  35  A   @modules/configs/excel2json/lua_chapter_puzzle_square
004c52b8  28  A   @modules/configs/excel2json/lua_currency
004d10a8  34  A   @modules/configs/excel2json/lua_chapter_map_fragment
004d64b8  27  A   @modules/configs/excel2json/lua_bp_task
004d8270  2b  A   @modules/configs/excel2json/lua_main_banner
004dd348  2d  A   @modules/configs/excel2json/lua_talent_scheme
004e2750  2a  A   @modules/configs/excel2json/lua_friendless
004e3658  2f  A   @modules/configs/excel2json/lua_explore_element
004e9048  33  A   @modules/configs/excel2json/lua_skill_passive_level
004ec2f8  2b  A   @modules/configs/excel2json/lua_activity105
004ed0a0  2e  A   @modules/configs/excel2json/lua_character_grow
004fe0b0  2f  A   @modules/configs/excel2json/lua_character_level
0050fdc8  24  A   @modules/configs/excel2json/lua_skin
00517ad0  36  A   @modules/configs/excel2json/lua_activity104_equip_attr
0051a190  31  A   @modules/configs/excel2json/lua_subclass_priority
0051b070  26  A   @modules/configs/excel2json/lua_bp_des
0051bc08  30  A   @modules/configs/excel2json/lua_activity109_task
0051cc48  27  A   @modules/configs/excel2json/lua_herocut
0051d688  37  A   @modules/configs/excel2json/lua_chapter_puzzle_question
0051e3d0  25  A   @modules/configs/excel2json/lua_store
0051ee50  33  A   @modules/configs/excel2json/lua_activity104_episode
0051fd78  30  A   @modules/configs/excel2json/lua_formula_showtype
00559538  2c  A   @modules/configs/excel2json/lua_explore_item
0055b4f0  28  A   @modules/configs/excel2json/lua_weekwalk
0055e440  2c  A   @modules/configs/excel2json/lua_weather_week
0055f3d8  2d  A   @modules/configs/excel2json/lua_weather_month
0055fd78  2d  A   @modules/configs/excel2json/lua_equip_chapter
00575988  28  A   @modules/configs/excel2json/lua_ui_audio
0059a3d8  2c  A   @modules/configs/excel2json/lua_skill_effect
0059c4c8  32  A   @modules/configs/excel2json/lua_skin_monster_scale
0059dc18  22  A   @modules/configs/excel2json/lua_bp
0059f940  2e  A   @modules/configs/excel2json/lua_weekwalk_bonus
007e3dc0  2f  A   @modules/configs/excel2json/lua_weekwalk_branch
007e48d0  2d  A   @modules/configs/excel2json/lua_weekwalk_buff
007e73a8  32  A   @modules/configs/excel2json/lua_activity108_dialog
007e8270  2b  A   @modules/configs/excel2json/lua_summon_pool
007f2010  30  A   @modules/configs/excel2json/lua_story_role_audio
007f2880  30  A   @modules/configs/excel2json/lua_activity112_task
007f3440  2d  A   @modules/configs/excel2json/lua_push_box_task
008029e0  32  A   @modules/configs/excel2json/lua_block_random_event
00804680  31  A   @modules/configs/excel2json/lua_weekwalk_question
00805870  2d  A   @modules/configs/excel2json/lua_weekwalk_pray
008061d0  30  A   @modules/configs/excel2json/lua_activity108_rule
00806c58  2e  A   @modules/configs/excel2json/lua_weekwalk_level
00807c10  32  A   @modules/configs/excel2json/lua_weekwalk_buff_pool
0080b608  30  A   @modules/configs/excel2json/lua_weekwalk_element
008e4d88  30  A   @modules/configs/excel2json/lua_character_talent
008ec570  31  A   @modules/configs/excel2json/lua_activity104_const
008ed160  2b  A   @modules/configs/excel2json/lua_weather_day
008eda60  33  A   @modules/configs/excel2json/lua_sign_in_addup_bonus
00923500  27  A   @modules/configs/excel2json/lua_episode
00931f00  32  A   @modules/configs/excel2json/lua_hero_effectiveness
0093f748  2a  A   @modules/configs/excel2json/lua_task_guide
00942318  2f  A   @modules/configs/excel2json/lua_storydialogfade
00946150  2a  A   @modules/configs/excel2json/lua_messagebox
0095fda8  2a  A   @modules/configs/excel2json/lua_room_theme
00960b00  31  A   @modules/configs/excel2json/lua_instruction_topic
00966d60  30  A   @modules/configs/excel2json/lua_equip_break_attr
009689b8  28  A   @modules/configs/excel2json/lua_item_use
009696b8  2b  A   @modules/configs/excel2json/lua_block_style
0096b1d0  33  A   @modules/configs/excel2json/lua_monster_guide_focus
0096cf90  3a  A   @modules/configs/excel2json/lua_chapter_puzzle_changecolor
0097c150  27  A   @modules/configs/excel2json/lua_monster
0097e818  2c  A   @modules/configs/excel2json/lua_explore_unit
00987d80  24  A   @modules/configs/excel2json/lua_item
00a1eca8  2e  A   @modules/configs/excel2json/lua_character_data
00a204b0  2a  A   @modules/configs/excel2json/lua_hero_trial
00a23240  30  A   @modules/configs/excel2json/lua_equip_strengthen
00a245e0  25  A   @modules/configs/excel2json/lua_cloth
00a26858  3b  A   @modules/configs/excel2json/lua_activity109_interact_object
00a2ae00  28  A   @modules/configs/excel2json/lua_bg_audio
00a2cbc0  3a  A   @modules/configs/excel2json/lua_room_character_interaction
00a2ff50  2f  A   @modules/configs/excel2json/lua_block_bonus_map
00a83b18  2a  A   @modules/configs/excel2json/lua_role_audio
00a84590  31  A   @modules/configs/excel2json/lua_effect_with_audio
00abf4b0  25  A   @modules/configs/excel2json/lua_block
00ac3e78  33  A   @modules/configs/excel2json/lua_adventure_buff_pool
00ad5430  2b  A   @modules/configs/excel2json/lua_chapter_map

Hello, I'd like to ask for specific instructions on how to export these Lua scripts. I used the GG modifier to search for the LuaJIT file header 1B4C4A02, and it returned over 8000 addresses. However, I'm not sure what to do next. I would greatly appreciate your guidance. Thank you very much.

66hh / 1999decrypt

Could you please give advice on decrypting the text? #5