Information pending...

by **NeoAnderson** » 26 Nov 2014, 16:37

thefiremind wrote:OK, I found the point where the program has the plain version of Header.xml.
...now what?

Honestly i don't know... anyway here is the look of the header :

Code: Select all: 058BB4E0 3C 3F 78 6D 6C 20 76 65 <?xml ve 058BB4E8 72 73 69 6F 6E 3D 22 31 rsion="1 058BB4F0 2E 30 22 3F 3E 0D 0A 0D .0"?>... 058BB4F8 0A 3C 68 65 61 64 65 72 .<header 058BB500 3E 0D 0A 09 3C 57 41 44 >...<WAD 058BB508 5F 48 45 41 44 45 52 3E _HEADER> 058BB510 0D 0A 09 09 3C 45 4E 54 ....<ENT 058BB518 52 59 20 70 6C 61 74 66 RY platf 058BB520 6F 72 6D 3D 22 41 4C 4C orm="ALL 058BB528 22 20 73 6F 75 72 63 65 " source 058BB530 3D 22 44 41 54 41 5F 30 ="DATA_0 058BB538 30 30 2F 44 41 54 41 5F 00/DATA_ 058BB540 41 4C 4C 5F 50 4C 41 54 ALL_PLAT 058BB548 46 4F 52 4D 53 2F 22 20 FORMS/" 058BB550 61 6C 69 61 73 3D 22 43 alias="C 058BB558 6F 6E 74 65 6E 74 22 20 ontent" 058BB560 6F 72 64 65 72 3D 22 31 order="1 058BB568 22 2F 3E 0D 0A 09 09 3C "/>....< 058BB570 45 4E 54 52 59 20 70 6C ENTRY pl 058BB578 61 74 66 6F 72 6D 3D 22 atform=" 058BB580 54 4F 55 43 48 22 20 73 TOUCH" s 058BB588 6F 75 72 63 65 3D 22 44 ource="D 058BB590 41 54 41 5F 30 30 30 2F ATA_000/ 058BB598 44 41 54 41 5F 54 4F 55 DATA_TOU 058BB5A0 43 48 2F 22 20 61 6C 69 CH/" ali 058BB5A8 61 73 3D 22 43 6F 6E 74 as="Cont 058BB5B0 65 6E 74 22 20 6F 72 64 ent" ord 058BB5B8 65 72 3D 22 32 22 2F 3E er="2"/> 058BB5C0 0D 0A 09 09 3C 45 4E 54 ....<ENT 058BB5C8 52 59 20 70 6C 61 74 66 RY platf 058BB5D0 6F 72 6D 3D 22 50 43 22 orm="PC" 058BB5D8 20 73 6F 75 72 63 65 3D source= 058BB5E0 22 44 41 54 41 5F 30 30 "DATA_00 058BB5E8 30 2F 44 41 54 41 5F 50 0/DATA_P 058BB5F0 43 2F 22 20 61 6C 69 61 C/" alia 058BB5F8 73 3D 22 43 6F 6E 74 65 s="Conte 058BB600 6E 74 22 20 6F 72 64 65 nt" orde 058BB608 72 3D 22 33 22 2F 3E 0D r="3"/>. 058BB610 0A 09 09 3C 45 4E 54 52 ...<ENTR 058BB618 59 20 70 6C 61 74 66 6F Y platfo 058BB620 72 6D 3D 22 58 33 36 30 rm="X360 058BB628 22 20 73 6F 75 72 63 65 " source 058BB630 3D 22 44 41 54 41 5F 30 ="DATA_0 058BB638 30 30 2F 44 41 54 41 5F 00/DATA_ 058BB640 58 33 36 30 2F 22 20 61 X360/" a 058BB648 6C 69 61 73 3D 22 43 6F lias="Co 058BB650 6E 74 65 6E 74 22 20 6F ntent" o 058BB658 72 64 65 72 3D 22 33 22 rder="3" 058BB660 2F 3E 0D 0A 09 09 3C 45 />....<E 058BB668 4E 54 52 59 20 70 6C 61 NTRY pla 058BB670 74 66 6F 72 6D 3D 22 50 tform="P 058BB678 53 33 22 20 73 6F 75 72 S3" sour 058BB680 63 65 3D 22 44 41 54 41 ce="DATA 058BB688 5F 30 30 30 2F 44 41 54 _000/DAT 058BB690 41 5F 50 53 33 2F 22 20 A_PS3/" 058BB698 61 6C 69 61 73 3D 22 43 alias="C 058BB6A0 6F 6E 74 65 6E 74 22 20 ontent" 058BB6A8 6F 72 64 65 72 3D 22 33 order="3 058BB6B0 22 2F 3E 0D 0A 09 09 3C "/>....< 058BB6B8 45 4E 54 52 59 20 70 6C ENTRY pl 058BB6C0 61 74 66 6F 72 6D 3D 22 atform=" 058BB6C8 49 50 41 44 22 20 73 6F IPAD" so 058BB6D0 75 72 63 65 3D 22 44 41 urce="DA 058BB6D8 54 41 5F 30 30 30 2F 44 TA_000/D 058BB6E0 41 54 41 5F 49 50 41 44 ATA_IPAD 058BB6E8 2F 22 20 61 6C 69 61 73 /" alias 058BB6F0 3D 22 43 6F 6E 74 65 6E ="Conten 058BB6F8 74 22 20 6F 72 64 65 72 t" order 058BB700 3D 22 33 22 2F 3E 0D 0A ="3"/>.. 058BB708 09 09 3C 45 4E 54 52 59 ..<ENTRY 058BB710 20 70 6C 61 74 66 6F 72 platfor 058BB718 6D 3D 22 41 4E 44 52 4F m="ANDRO 058BB720 49 44 22 20 73 6F 75 72 ID" sour 058BB728 63 65 3D 22 44 41 54 41 ce="DATA 058BB730 5F 30 30 30 2F 44 41 54 _000/DAT 058BB738 41 5F 41 4E 44 52 4F 49 A_ANDROI 058BB740 44 2F 22 20 61 6C 69 61 D/" alia 058BB748 73 3D 22 43 6F 6E 74 65 s="Conte 058BB750 6E 74 22 20 6F 72 64 65 nt" orde 058BB758 72 3D 22 33 22 2F 3E 0D r="3"/>. 058BB760 0A 09 09 3C 45 4E 54 52 ...<ENTR 058BB768 59 20 70 6C 61 74 66 6F Y platfo 058BB770 72 6D 3D 22 58 42 4F 58 rm="XBOX 058BB778 5F 4F 4E 45 22 20 73 6F _ONE" so 058BB780 75 72 63 65 3D 22 44 41 urce="DA 058BB788 54 41 5F 30 30 30 2F 44 TA_000/D 058BB790 41 54 41 5F 58 42 4F 58 ATA_XBOX 058BB798 4F 4E 45 2F 22 20 61 6C ONE/" al 058BB7A0 69 61 73 3D 22 43 6F 6E ias="Con 058BB7A8 74 65 6E 74 22 20 6F 72 tent" or 058BB7B0 64 65 72 3D 22 33 22 2F der="3"/ 058BB7B8 3E 0D 0A 09 09 3C 45 4E >....<EN 058BB7C0 54 52 59 20 70 6C 61 74 TRY plat 058BB7C8 66 6F 72 6D 3D 22 41 4E form="AN 058BB7D0 44 52 4F 49 44 4C 4F 57 DROIDLOW 058BB7D8 52 45 53 22 20 73 6F 75 RES" sou 058BB7E0 72 63 65 3D 22 44 41 54 rce="DAT 058BB7E8 41 5F 30 30 30 2F 44 41 A_000/DA 058BB7F0 54 41 5F 41 4E 44 52 4F TA_ANDRO 058BB7F8 49 44 4C 4F 57 52 45 53 IDLOWRES 058BB800 2F 22 20 61 6C 69 61 73 /" alias 058BB808 3D 22 43 6F 6E 74 65 6E ="Conten 058BB810 74 22 20 6F 72 64 65 72 t" order 058BB818 3D 22 34 22 2F 3E 0D 0A ="4"/>.. 058BB820 09 3C 2F 57 41 44 5F 48 .</WAD_H 058BB828 45 41 44 45 52 3E 0D 0A EADER>.. 058BB830 09 0D 0A 09 3C 43 6F 6E ....<Con 058BB838 74 65 6E 74 50 61 63 6B tentPack 058BB840 20 55 49 44 3D 22 31 22 UID="1" 058BB848 3E 0D 0A 09 09 3C 43 6F >....<Co 058BB850 6E 74 65 6E 74 46 6C 61 ntentFla 058BB858 67 73 3E 0D 0A 09 09 09 gs>..... 058BB860 3C 53 4C 49 43 45 44 5F <SLICED_ 058BB868 43 4F 4E 54 45 4E 54 2F CONTENT/ 058BB870 3E 0D 0A 09 09 09 3C 52 >.....<R 058BB878 45 4C 4F 41 44 5F 41 4C ELOAD_AL 058BB880 4C 5F 43 4F 4E 54 45 4E L_CONTEN 058BB888 54 2F 3E 0D 0A 09 09 3C T/>....< 058BB890 2F 43 6F 6E 74 65 6E 74 /Content 058BB898 46 6C 61 67 73 3E 0D 0A Flags>.. 058BB8A0 09 09 0D 0A 09 09 3C 50 ......<P 058BB8A8 44 5F 53 65 63 74 69 6F D_Sectio 058BB8B0 6E 3E 0D 0A 09 09 09 3C n>.....< 058BB8B8 41 4E 44 52 4F 49 44 5F ANDROID_ 058BB8C0 53 4B 55 20 73 6B 75 3D SKU sku= 058BB8C8 22 64 31 35 5F 74 68 65 "d15_the 058BB8D0 72 6F 73 5F 63 68 61 70 ros_chap 058BB8D8 74 65 72 22 2F 3E 0D 0A ter"/>.. 058BB8E0 09 09 09 3C 49 4F 53 5F ...<IOS_ 058BB8E8 53 4B 55 20 73 6B 75 3D SKU sku= 058BB8F0 22 44 31 35 5F 54 48 45 "D15_THE 058BB8F8 52 4F 53 5F 43 48 41 50 ROS_CHAP 058BB900 54 45 52 22 2F 3E 0D 0A TER"/>.. 058BB908 09 09 09 3C 49 4F 53 5F ...<IOS_ 058BB910 42 55 4E 44 4C 45 5F 53 BUNDLE_S 058BB918 4B 55 20 73 6B 75 3D 22 KU sku=" 058BB920 44 31 35 5F 43 4F 4D 50 D15_COMP 058BB928 4C 45 54 45 5F 42 55 4E LETE_BUN 058BB930 44 4C 45 22 2F 3E 0D 0A DLE"/>.. 058BB938 09 09 09 3C 41 4E 44 52 ...<ANDR 058BB940 4F 49 44 5F 42 55 4E 44 OID_BUND 058BB948 4C 45 5F 53 4B 55 20 73 LE_SKU s 058BB950 6B 75 3D 22 64 31 35 5F ku="d15_ 058BB958 63 6F 6D 70 6C 65 74 65 complete 058BB960 5F 62 75 6E 64 6C 65 22 _bundle" 058BB968 2F 3E 0D 0A 09 09 09 3C />.....< 058BB970 49 4F 53 5F 43 48 41 50 IOS_CHAP 058BB978 54 45 52 5F 42 55 4E 44 TER_BUND 058BB980 4C 45 5F 53 4B 55 20 73 LE_SKU s 058BB988 6B 75 3D 22 44 31 35 5F ku="D15_ 058BB990 43 48 41 50 54 45 52 5F CHAPTER_ 058BB998 42 55 4E 44 4C 45 22 2F BUNDLE"/ 058BB9A0 3E 0D 0A 09 09 09 3C 41 >.....<A 058BB9A8 4E 44 52 4F 49 44 5F 43 NDROID_C 058BB9B0 48 41 50 54 45 52 5F 42 HAPTER_B 058BB9B8 55 4E 44 4C 45 5F 53 4B UNDLE_SK 058BB9C0 55 20 73 6B 75 3D 22 64 U sku="d 058BB9C8 31 35 5F 61 6C 6C 5F 63 15_all_c 058BB9D0 68 61 70 74 65 72 73 22 hapters" 058BB9D8 2F 3E 0D 0A 09 09 3C 2F />....</ 058BB9E0 50 44 5F 53 65 63 74 69 PD_Secti 058BB9E8 6F 6E 3E 0D 0A 09 09 0D on>..... 058BB9F0 0A 09 3C 2F 43 6F 6E 74 ..</Cont 058BB9F8 65 6E 74 50 61 63 6B 3E entPack> 058BBA00 0D 0A 09 0D 0A 09 3C 43 ......<C 058BBA08 6F 6E 74 65 6E 74 50 61 ontentPa 058BBA10 63 6B 20 55 49 44 3D 22 ck UID=" 058BBA18 32 22 3E 0D 0A 09 09 3C 2">....< 058BBA20 43 6F 6E 74 65 6E 74 46 ContentF 058BBA28 6C 61 67 73 3E 0D 0A 09 lags>... 058BBA30 09 09 3C 53 4C 49 43 45 ..<SLICE 058BBA38 44 5F 43 4F 4E 54 45 4E D_CONTEN 058BBA40 54 2F 3E 0D 0A 09 09 09 T/>..... 058BBA48 3C 52 45 4C 4F 41 44 5F <RELOAD_ 058BBA50 41 4C 4C 5F 43 4F 4E 54 ALL_CONT 058BBA58 45 4E 54 2F 3E 0D 0A 09 ENT/>... 058BBA60 09 3C 2F 43 6F 6E 74 65 .</Conte 058BBA68 6E 74 46 6C 61 67 73 3E ntFlags> 058BBA70 0D 0A 09 09 0D 0A 09 09 ........ 058BBA78 3C 50 44 5F 53 65 63 74 <PD_Sect 058BBA80 69 6F 6E 3E 0D 0A 09 09 ion>.... 058BBA88 09 3C 41 4E 44 52 4F 49 .<ANDROI 058BBA90 44 5F 53 4B 55 20 73 6B D_SKU sk 058BBA98 75 3D 22 64 31 35 5F 72 u="d15_r 058BBAA0 61 76 6E 69 63 61 5F 63 avnica_c 058BBAA8 68 61 70 74 65 72 22 2F hapter"/ 058BBAB0 3E 0D 0A 09 09 09 3C 49 >.....<I 058BBAB8 4F 53 5F 53 4B 55 20 73 OS_SKU s 058BBAC0 6B 75 3D 22 44 31 35 5F ku="D15_ 058BBAC8 52 41 56 4E 49 43 41 5F RAVNICA_ 058BBAD0 43 48 41 50 54 45 52 22 CHAPTER" 058BBAD8 2F 3E 0D 0A 09 09 09 3C />.....< 058BBAE0 49 4F 53 5F 42 55 4E 44 IOS_BUND 058BBAE8 4C 45 5F 53 4B 55 20 73 LE_SKU s 058BBAF0 6B 75 3D 22 44 31 35 5F ku="D15_ 058BBAF8 43 4F 4D 50 4C 45 54 45 COMPLETE 058BBB00 5F 42 55 4E 44 4C 45 22 _BUNDLE" 058BBB08 2F 3E 0D 0A 09 09 09 3C />.....< 058BBB10 41 4E 44 52 4F 49 44 5F ANDROID_ 058BBB18 42 55 4E 44 4C 45 5F 53 BUNDLE_S 058BBB20 4B 55 20 73 6B 75 3D 22 KU sku=" 058BBB28 64 31 35 5F 63 6F 6D 70 d15_comp 058BBB30 6C 65 74 65 5F 62 75 6E lete_bun 058BBB38 64 6C 65 22 2F 3E 0D 0A dle"/>.. 058BBB40 09 09 09 3C 49 4F 53 5F ...<IOS_ 058BBB48 43 48 41 50 54 45 52 5F CHAPTER_ 058BBB50 42 55 4E 44 4C 45 5F 53 BUNDLE_S 058BBB58 4B 55 20 73 6B 75 3D 22 KU sku=" 058BBB60 44 31 35 5F 43 48 41 50 D15_CHAP 058BBB68 54 45 52 5F 42 55 4E 44 TER_BUND 058BBB70 4C 45 22 2F 3E 0D 0A 09 LE"/>... 058BBB78 09 09 3C 41 4E 44 52 4F ..<ANDRO 058BBB80 49 44 5F 43 48 41 50 54 ID_CHAPT 058BBB88 45 52 5F 42 55 4E 44 4C ER_BUNDL 058BBB90 45 5F 53 4B 55 20 73 6B E_SKU sk 058BBB98 75 3D 22 64 31 35 5F 61 u="d15_a 058BBBA0 6C 6C 5F 63 68 61 70 74 ll_chapt 058BBBA8 65 72 73 22 2F 3E 0D 0A ers"/>.. 058BBBB0 09 09 3C 2F 50 44 5F 53 ..</PD_S 058BBBB8 65 63 74 69 6F 6E 3E 0D ection>. 058BBBC0 0A 09 09 0D 0A 09 3C 2F ......</ 058BBBC8 43 6F 6E 74 65 6E 74 50 ContentP 058BBBD0 61 63 6B 3E 0D 0A 09 0D ack>.... 058BBBD8 0A 09 3C 43 6F 6E 74 65 ..<Conte 058BBBE0 6E 74 50 61 63 6B 20 55 ntPack U 058BBBE8 49 44 3D 22 33 22 3E 0D ID="3">. 058BBBF0 0A 09 09 3C 43 6F 6E 74 ...<Cont 058BBBF8 65 6E 74 46 6C 61 67 73 entFlags 058BBC00 3E 0D 0A 09 09 09 3C 53 >.....<S 058BBC08 4C 49 43 45 44 5F 43 4F LICED_CO 058BBC10 4E 54 45 4E 54 2F 3E 0D NTENT/>. 058BBC18 0A 09 09 09 3C 52 45 4C ....<REL 058BBC20 4F 41 44 5F 41 4C 4C 5F OAD_ALL_ 058BBC28 43 4F 4E 54 45 4E 54 2F CONTENT/ 058BBC30 3E 0D 0A 09 09 3C 2F 43 >....</C 058BBC38 6F 6E 74 65 6E 74 46 6C ontentFl 058BBC40 61 67 73 3E 0D 0A 09 09 ags>.... 058BBC48 0D 0A 09 09 3C 50 44 5F ....<PD_ 058BBC50 53 65 63 74 69 6F 6E 3E Section> 058BBC58 0D 0A 09 09 09 3C 41 4E .....<AN 058BBC60 44 52 4F 49 44 5F 53 4B DROID_SK 058BBC68 55 20 73 6B 75 3D 22 64 U sku="d 058BBC70 31 35 5F 73 68 61 6E 64 15_shand 058BBC78 61 6C 61 72 5F 63 68 61 alar_cha 058BBC80 70 74 65 72 22 2F 3E 0D pter"/>. 058BBC88 0A 09 09 09 3C 49 4F 53 ....<IOS 058BBC90 5F 53 4B 55 20 73 6B 75 _SKU sku 058BBC98 3D 22 44 31 35 5F 53 48 ="D15_SH 058BBCA0 41 4E 44 41 4C 41 52 5F ANDALAR_ 058BBCA8 43 48 41 50 54 45 52 22 CHAPTER" 058BBCB0 2F 3E 0D 0A 09 09 09 3C />.....< 058BBCB8 49 4F 53 5F 42 55 4E 44 IOS_BUND 058BBCC0 4C 45 5F 53 4B 55 20 73 LE_SKU s 058BBCC8 6B 75 3D 22 44 31 35 5F ku="D15_ 058BBCD0 43 4F 4D 50 4C 45 54 45 COMPLETE 058BBCD8 5F 42 55 4E 44 4C 45 22 _BUNDLE" 058BBCE0 2F 3E 0D 0A 09 09 09 3C />.....< 058BBCE8 41 4E 44 52 4F 49 44 5F ANDROID_ 058BBCF0 42 55 4E 44 4C 45 5F 53 BUNDLE_S 058BBCF8 4B 55 20 73 6B 75 3D 22 KU sku=" 058BBD00 64 31 35 5F 63 6F 6D 70 d15_comp 058BBD08 6C 65 74 65 5F 62 75 6E lete_bun 058BBD10 64 6C 65 22 2F 3E 0D 0A dle"/>.. 058BBD18 09 09 09 3C 49 4F 53 5F ...<IOS_ 058BBD20 43 48 41 50 54 45 52 5F CHAPTER_ 058BBD28 42 55 4E 44 4C 45 5F 53 BUNDLE_S 058BBD30 4B 55 20 73 6B 75 3D 22 KU sku=" 058BBD38 44 31 35 5F 43 48 41 50 D15_CHAP 058BBD40 54 45 52 5F 42 55 4E 44 TER_BUND 058BBD48 4C 45 22 2F 3E 0D 0A 09 LE"/>... 058BBD50 09 09 3C 41 4E 44 52 4F ..<ANDRO 058BBD58 49 44 5F 43 48 41 50 54 ID_CHAPT 058BBD60 45 52 5F 42 55 4E 44 4C ER_BUNDL 058BBD68 45 5F 53 4B 55 20 73 6B E_SKU sk 058BBD70 75 3D 22 64 31 35 5F 61 u="d15_a 058BBD78 6C 6C 5F 63 68 61 70 74 ll_chapt 058BBD80 65 72 73 22 2F 3E 0D 0A ers"/>.. 058BBD88 09 09 3C 2F 50 44 5F 53 ..</PD_S 058BBD90 65 63 74 69 6F 6E 3E 0D ection>. 058BBD98 0A 09 09 0D 0A 09 3C 2F ......</ 058BBDA0 43 6F 6E 74 65 6E 74 50 ContentP 058BBDA8 61 63 6B 3E 0D 0A 09 0D ack>.... 058BBDB0 0A 09 3C 43 6F 6E 74 65 ..<Conte 058BBDB8 6E 74 50 61 63 6B 20 55 ntPack U 058BBDC0 49 44 3D 22 34 22 3E 0D ID="4">. 058BBDC8 0A 09 09 3C 43 6F 6E 74 ...<Cont 058BBDD0 65 6E 74 46 6C 61 67 73 entFlags 058BBDD8 3E 0D 0A 09 09 09 3C 53 >.....<S 058BBDE0 4C 49 43 45 44 5F 43 4F LICED_CO 058BBDE8 4E 54 45 4E 54 2F 3E 0D NTENT/>. 058BBDF0 0A 09 09 09 3C 52 45 4C ....<REL 058BBDF8 4F 41 44 5F 41 4C 4C 5F OAD_ALL_ 058BBE00 43 4F 4E 54 45 4E 54 2F CONTENT/ 058BBE08 3E 0D 0A 09 09 3C 2F 43 >....</C 058BBE10 6F 6E 74 65 6E 74 46 6C ontentFl 058BBE18 61 67 73 3E 0D 0A 09 09 ags>.... 058BBE20 0D 0A 09 09 3C 50 44 5F ....<PD_ 058BBE28 53 65 63 74 69 6F 6E 3E Section> 058BBE30 0D 0A 09 09 09 3C 41 4E .....<AN 058BBE38 44 52 4F 49 44 5F 53 4B DROID_SK 058BBE40 55 20 73 6B 75 3D 22 64 U sku="d 058BBE48 31 35 5F 7A 65 6E 64 69 15_zendi 058BBE50 6B 61 72 5F 63 68 61 70 kar_chap 058BBE58 74 65 72 22 2F 3E 0D 0A ter"/>.. 058BBE60 09 09 09 3C 49 4F 53 5F ...<IOS_ 058BBE68 53 4B 55 20 73 6B 75 3D SKU sku= 058BBE70 22 44 31 35 5F 5A 45 4E "D15_ZEN 058BBE78 44 49 4B 41 52 5F 43 48 DIKAR_CH 058BBE80 41 50 54 45 52 22 2F 3E APTER"/> 058BBE88 0D 0A 09 09 09 3C 49 4F .....<IO 058BBE90 53 5F 42 55 4E 44 4C 45 S_BUNDLE 058BBE98 5F 53 4B 55 20 73 6B 75 _SKU sku 058BBEA0 3D 22 44 31 35 5F 43 4F ="D15_CO 058BBEA8 4D 50 4C 45 54 45 5F 42 MPLETE_B 058BBEB0 55 4E 44 4C 45 22 2F 3E UNDLE"/> 058BBEB8 0D 0A 09 09 09 3C 41 4E .....<AN 058BBEC0 44 52 4F 49 44 5F 42 55 DROID_BU 058BBEC8 4E 44 4C 45 5F 53 4B 55 NDLE_SKU 058BBED0 20 73 6B 75 3D 22 64 31 sku="d1 058BBED8 35 5F 63 6F 6D 70 6C 65 5_comple 058BBEE0 74 65 5F 62 75 6E 64 6C te_bundl 058BBEE8 65 22 2F 3E 0D 0A 09 09 e"/>.... 058BBEF0 09 3C 49 4F 53 5F 43 48 .<IOS_CH 058BBEF8 41 50 54 45 52 5F 42 55 APTER_BU 058BBF00 4E 44 4C 45 5F 53 4B 55 NDLE_SKU 058BBF08 20 73 6B 75 3D 22 44 31 sku="D1 058BBF10 35 5F 43 48 41 50 54 45 5_CHAPTE 058BBF18 52 5F 42 55 4E 44 4C 45 R_BUNDLE 058BBF20 22 2F 3E 0D 0A 09 09 09 "/>..... 058BBF28 3C 41 4E 44 52 4F 49 44 <ANDROID 058BBF30 5F 43 48 41 50 54 45 52 _CHAPTER 058BBF38 5F 42 55 4E 44 4C 45 5F _BUNDLE_ 058BBF40 53 4B 55 20 73 6B 75 3D SKU sku= 058BBF48 22 64 31 35 5F 61 6C 6C "d15_all 058BBF50 5F 63 68 61 70 74 65 72 _chapter 058BBF58 73 22 2F 3E 0D 0A 09 09 s"/>.... 058BBF60 3C 2F 50 44 5F 53 65 63 </PD_Sec 058BBF68 74 69 6F 6E 3E 0D 0A 09 tion>... 058BBF70 09 0D 0A 09 3C 2F 43 6F ....</Co 058BBF78 6E 74 65 6E 74 50 61 63 ntentPac 058BBF80 6B 3E 0D 0A 09 0D 0A 3C k>.....< 058BBF88 2F 68 65 61 64 65 72 3E /header> 058BBF90 F5 F0 D3 38 88 78 21 00 ...8.x!. 058BBF98 18 BD 89 05 98 94 89 05

by **NeoAnderson** » 27 Nov 2014, 01:50

I have scanned the DotP_D15.exe (Codex ver. 1) with PEiD v 0.95.
I used the plugin for the Crypto Signatures(KANAL v2.92) and this is the result :

Crypto Signatures(KANAL v2.92) | Open

Code: Select all: ADLER32 :: 001506ED :: 005512ED The reference is above. CRC32 :: 00797670 :: 00B99C70 Referenced at 00939684 Referenced at 0093969A Referenced at 009396B9 Referenced at 009396CF Referenced at 009396E5 Referenced at 009396FB Referenced at 00939711 Referenced at 00939727 CRC32 :: 007D7908 :: 00BD9F08 Referenced at 005517D3 Referenced at 0055181B Referenced at 00551854 Referenced at 0055188E Referenced at 005518C8 Referenced at 00551902 Referenced at 0055193F Referenced at 0055197F Referenced at 005519B9 Referenced at 00551A10 Referenced at 00551A37 MD5 :: 00511B41 :: 00912741 The reference is above. SHA1 [Compress] :: 00165B8B :: 0056678B The reference is above. SHA-256 [mixing] :: 00790DF8 :: 00B933F8 Referenced at 00902D4F Referenced at 00902D92 Referenced at 00902DBE Referenced at 00902EAD SHA-256 [mixing] :: 007DA3A0 :: 00BDC9A0 The reference is above. SHA-384 [Init] :: 00790B38 :: 00B93138 The reference is above. SHA-512 [init] :: 00790AF8 :: 00B930F8 The reference is above. ZLIB deflate [word] :: 007D99F0 :: 00BDBFF0 Referenced at 00551C05

Scanning the Exe with Hash & Crypto Detector v1.4 the result are :

Crypto Signatures(Hash & Crypto Detector v1.4) | Open

Code: Select all: Function Name : CRC32 Offset Address : 00797870 Virtual Address : 00B99E70 FCT.Information : A cyclic redundancy check (CRC) is a non-secure hash function Function Name : CRC32 Offset Address : 00797678 Virtual Address : 00B99C78 FCT.Information : A cyclic redundancy check (CRC) is a non-secure hash function Function Name : MD4 Offset Address : 00165376 Virtual Address : 00565F76 FCT.Information : MD4 is a message digest algorithm designed by Ronald Rivest of MIT in 1990 Function Name : MD5 Offset Address : 00511B24 Virtual Address : 00912724 FCT.Information : MD5 is a widely used Cryptographic hash function with a 128-bit hash value Function Name : SHA-0/SHA-1 Offset Address : 00165B8B Virtual Address : 0056678B FCT.Information : The SHA is a set of cryptographic hash function designed by (NSA) in 1993 Function Name : SHA-256 Offset Address : 00790ADC Virtual Address : 00B930DC FCT.Information : Cryptographic hash function (SHA-2 family) with (256 bits) digest length Function Name : SHA-384 Offset Address : 00790B38 Virtual Address : 00B93138 FCT.Information : Cryptographic hash function (SHA-2 family) with (384 bits) digest length Function Name : SHA-512 Offset Address : 00790AF8 Virtual Address : 00B930F8 FCT.Information : Cryptographic hash function (SHA-2 family) with (512 bits) digest length Function Name : SHACAL Offset Address : 00790DF8 Virtual Address : 00B933F8 FCT.Information : SHACAL-1 && SHACAL-2 are block ciphers based on hash from the SHA family Function Name : CryptDecrypt Offset Address : 00876F38 Virtual Address : 00C79B38 FCT.Information : Microsoft CryptoAPI function, decrypts data previously encrypted by CryptEncrypt Function Name : Crypto++ Library Offset Address : 0089B309 Virtual Address : 00C9DF09 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Zlib Compression Offset Address : 0087EF38 Virtual Address : 00C81B38 FCT.Information : Zlib is a software library used for data compression

Crypto Signatures(Hash & Crypto Detector v1.4) - TOTAL SCAN | Open

Code: Select all: Function Name : CRC32 Offset Address : 00797870 Virtual Address : 00B99E70 FCT.Information : A cyclic redundancy check (CRC) is a non-secure hash function Function Name : CRC32 Offset Address : 00797678 Virtual Address : 00B99C78 FCT.Information : A cyclic redundancy check (CRC) is a non-secure hash function Function Name : MD4 Offset Address : 00165376 Virtual Address : 00565F76 FCT.Information : MD4 is a message digest algorithm designed by Ronald Rivest of MIT in 1990 Function Name : MD5 Offset Address : 00511B24 Virtual Address : 00912724 FCT.Information : MD5 is a widely used Cryptographic hash function with a 128-bit hash value Function Name : SHA-0/SHA-1 Offset Address : 00165B8B Virtual Address : 0056678B FCT.Information : The SHA is a set of cryptographic hash function designed by (NSA) in 1993 Function Name : SHA-256 Offset Address : 00790ADC Virtual Address : 00B930DC FCT.Information : Cryptographic hash function (SHA-2 family) with (256 bits) digest length Function Name : SHA-384 Offset Address : 00790B38 Virtual Address : 00B93138 FCT.Information : Cryptographic hash function (SHA-2 family) with (384 bits) digest length Function Name : SHA-512 Offset Address : 00790AF8 Virtual Address : 00B930F8 FCT.Information : Cryptographic hash function (SHA-2 family) with (512 bits) digest length Function Name : SHACAL Offset Address : 00790DF8 Virtual Address : 00B933F8 FCT.Information : SHACAL-1 && SHACAL-2 are block ciphers based on hash from the SHA family Function Name : CryptDecrypt Offset Address : 00876F38 Virtual Address : 00C79B38 FCT.Information : Microsoft CryptoAPI function, decrypts data previously encrypted by CryptEncrypt Function Name : Crypto++ Library Offset Address : 0089B309 Virtual Address : 00C9DF09 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Zlib Compression Offset Address : 0087EF38 Virtual Address : 00C81B38 FCT.Information : Zlib is a software library used for data compression Function Name : Adler32 Offset Address : 001506ED Virtual Address : 005512ED FCT.Information : Adler-32 is a checksum algorithm which was invented by Mark Adler Function Name : Adler32 Offset Address : 0015079F Virtual Address : 0055139F FCT.Information : Adler-32 is a checksum algorithm which was invented by Mark Adler Function Name : Adler32 Offset Address : 001507B3 Virtual Address : 005513B3 FCT.Information : Adler-32 is a checksum algorithm which was invented by Mark Adler Function Name : CRC32 Offset Address : 00797870 Virtual Address : 00B99E70 FCT.Information : A cyclic redundancy check (CRC) is a non-secure hash function Function Name : CRC32 Offset Address : 007D7B08 Virtual Address : 00BDA108 FCT.Information : A cyclic redundancy check (CRC) is a non-secure hash function Function Name : CRC32 Offset Address : 00797678 Virtual Address : 00B99C78 FCT.Information : A cyclic redundancy check (CRC) is a non-secure hash function Function Name : CRC32 Offset Address : 007D7910 Virtual Address : 00BD9F10 FCT.Information : A cyclic redundancy check (CRC) is a non-secure hash function Function Name : MD4 Offset Address : 00165376 Virtual Address : 00565F76 FCT.Information : MD4 is a message digest algorithm designed by Ronald Rivest of MIT in 1990 Function Name : MD4 Offset Address : 00165385 Virtual Address : 00565F85 FCT.Information : MD4 is a message digest algorithm designed by Ronald Rivest of MIT in 1990 Function Name : MD4 Offset Address : 001653C8 Virtual Address : 00565FC8 FCT.Information : MD4 is a message digest algorithm designed by Ronald Rivest of MIT in 1990 Function Name : MD4 Offset Address : 001653EB Virtual Address : 00565FEB FCT.Information : MD4 is a message digest algorithm designed by Ronald Rivest of MIT in 1990 Function Name : MD4 Offset Address : 001653FF Virtual Address : 00565FFF FCT.Information : MD4 is a message digest algorithm designed by Ronald Rivest of MIT in 1990 Function Name : MD4 Offset Address : 00165435 Virtual Address : 00566035 FCT.Information : MD4 is a message digest algorithm designed by Ronald Rivest of MIT in 1990 Function Name : MD4 Offset Address : 00165462 Virtual Address : 00566062 FCT.Information : MD4 is a message digest algorithm designed by Ronald Rivest of MIT in 1990 Function Name : MD4 Offset Address : 00165492 Virtual Address : 00566092 FCT.Information : MD4 is a message digest algorithm designed by Ronald Rivest of MIT in 1990 Function Name : MD4 Offset Address : 001654C2 Virtual Address : 005660C2 FCT.Information : MD4 is a message digest algorithm designed by Ronald Rivest of MIT in 1990 Function Name : MD4 Offset Address : 0016550E Virtual Address : 0056610E FCT.Information : MD4 is a message digest algorithm designed by Ronald Rivest of MIT in 1990 Function Name : MD4 Offset Address : 00165522 Virtual Address : 00566122 FCT.Information : MD4 is a message digest algorithm designed by Ronald Rivest of MIT in 1990 Function Name : MD4 Offset Address : 00165552 Virtual Address : 00566152 FCT.Information : MD4 is a message digest algorithm designed by Ronald Rivest of MIT in 1990 Function Name : MD4 Offset Address : 00165582 Virtual Address : 00566182 FCT.Information : MD4 is a message digest algorithm designed by Ronald Rivest of MIT in 1990 Function Name : MD4 Offset Address : 001655B2 Virtual Address : 005661B2 FCT.Information : MD4 is a message digest algorithm designed by Ronald Rivest of MIT in 1990 Function Name : MD4 Offset Address : 001655FE Virtual Address : 005661FE FCT.Information : MD4 is a message digest algorithm designed by Ronald Rivest of MIT in 1990 Function Name : MD4 Offset Address : 00165612 Virtual Address : 00566212 FCT.Information : MD4 is a message digest algorithm designed by Ronald Rivest of MIT in 1990 Function Name : MD4 Offset Address : 00165642 Virtual Address : 00566242 FCT.Information : MD4 is a message digest algorithm designed by Ronald Rivest of MIT in 1990 Function Name : MD4 Offset Address : 00165690 Virtual Address : 00566290 FCT.Information : MD4 is a message digest algorithm designed by Ronald Rivest of MIT in 1990 Function Name : MD4 Offset Address : 001656BD Virtual Address : 005662BD FCT.Information : MD4 is a message digest algorithm designed by Ronald Rivest of MIT in 1990 Function Name : MD4 Offset Address : 001656DE Virtual Address : 005662DE FCT.Information : MD4 is a message digest algorithm designed by Ronald Rivest of MIT in 1990 Function Name : MD5 Offset Address : 00511B24 Virtual Address : 00912724 FCT.Information : MD5 is a widely used Cryptographic hash function with a 128-bit hash value Function Name : SHA-0/SHA-1 Offset Address : 00165B8B Virtual Address : 0056678B FCT.Information : The SHA is a set of cryptographic hash function designed by (NSA) in 1993 Function Name : SHA-0/SHA-1 Offset Address : 00165BB8 Virtual Address : 005667B8 FCT.Information : The SHA is a set of cryptographic hash function designed by (NSA) in 1993 Function Name : SHA-0/SHA-1 Offset Address : 00165BE8 Virtual Address : 005667E8 FCT.Information : The SHA is a set of cryptographic hash function designed by (NSA) in 1993 Function Name : SHA-0/SHA-1 Offset Address : 00165C11 Virtual Address : 00566811 FCT.Information : The SHA is a set of cryptographic hash function designed by (NSA) in 1993 Function Name : SHA-0/SHA-1 Offset Address : 00165C1A Virtual Address : 0056681A FCT.Information : The SHA is a set of cryptographic hash function designed by (NSA) in 1993 Function Name : SHA-0/SHA-1 Offset Address : 00165C45 Virtual Address : 00566845 FCT.Information : The SHA is a set of cryptographic hash function designed by (NSA) in 1993 Function Name : SHA-0/SHA-1 Offset Address : 00165C78 Virtual Address : 00566878 FCT.Information : The SHA is a set of cryptographic hash function designed by (NSA) in 1993 Function Name : SHA-0/SHA-1 Offset Address : 00165CD4 Virtual Address : 005668D4 FCT.Information : The SHA is a set of cryptographic hash function designed by (NSA) in 1993 Function Name : SHA-0/SHA-1 Offset Address : 00165D01 Virtual Address : 00566901 FCT.Information : The SHA is a set of cryptographic hash function designed by (NSA) in 1993 Function Name : SHA-0/SHA-1 Offset Address : 00165D20 Virtual Address : 00566920 FCT.Information : The SHA is a set of cryptographic hash function designed by (NSA) in 1993 Function Name : SHA-0/SHA-1 Offset Address : 00165D3A Virtual Address : 0056693A FCT.Information : The SHA is a set of cryptographic hash function designed by (NSA) in 1993 Function Name : SHA-0/SHA-1 Offset Address : 00165D6C Virtual Address : 0056696C FCT.Information : The SHA is a set of cryptographic hash function designed by (NSA) in 1993 Function Name : SHA-0/SHA-1 Offset Address : 00165DCA Virtual Address : 005669CA FCT.Information : The SHA is a set of cryptographic hash function designed by (NSA) in 1993 Function Name : SHA-0/SHA-1 Offset Address : 00165DF3 Virtual Address : 005669F3 FCT.Information : The SHA is a set of cryptographic hash function designed by (NSA) in 1993 Function Name : SHA-0/SHA-1 Offset Address : 00165E24 Virtual Address : 00566A24 FCT.Information : The SHA is a set of cryptographic hash function designed by (NSA) in 1993 Function Name : SHA-0/SHA-1 Offset Address : 00165E5F Virtual Address : 00566A5F FCT.Information : The SHA is a set of cryptographic hash function designed by (NSA) in 1993 Function Name : SHA-0/SHA-1 Offset Address : 00165E8D Virtual Address : 00566A8D FCT.Information : The SHA is a set of cryptographic hash function designed by (NSA) in 1993 Function Name : SHA-0/SHA-1 Offset Address : 00165EBA Virtual Address : 00566ABA FCT.Information : The SHA is a set of cryptographic hash function designed by (NSA) in 1993 Function Name : SHA-0/SHA-1 Offset Address : 00165EED Virtual Address : 00566AED FCT.Information : The SHA is a set of cryptographic hash function designed by (NSA) in 1993 Function Name : SHA-0/SHA-1 Offset Address : 00165F26 Virtual Address : 00566B26 FCT.Information : The SHA is a set of cryptographic hash function designed by (NSA) in 1993 Function Name : SHA-256 Offset Address : 00790ADC Virtual Address : 00B930DC FCT.Information : Cryptographic hash function (SHA-2 family) with (256 bits) digest length Function Name : SHA-256 Offset Address : 00790B2C Virtual Address : 00B9312C FCT.Information : Cryptographic hash function (SHA-2 family) with (256 bits) digest length Function Name : SHA-384 Offset Address : 00790B38 Virtual Address : 00B93138 FCT.Information : Cryptographic hash function (SHA-2 family) with (384 bits) digest length Function Name : SHA-512 Offset Address : 00790AF8 Virtual Address : 00B930F8 FCT.Information : Cryptographic hash function (SHA-2 family) with (512 bits) digest length Function Name : SHACAL Offset Address : 00790DF8 Virtual Address : 00B933F8 FCT.Information : SHACAL-1 && SHACAL-2 are block ciphers based on hash from the SHA family Function Name : SHACAL Offset Address : 007DA3A0 Virtual Address : 00BDC9A0 FCT.Information : SHACAL-1 && SHACAL-2 are block ciphers based on hash from the SHA family Function Name : CryptDecrypt Offset Address : 00876F38 Virtual Address : 00C79B38 FCT.Information : Microsoft CryptoAPI function, decrypts data previously encrypted by CryptEncrypt Function Name : Crypto++ Library Offset Address : 0089B309 Virtual Address : 00C9DF09 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B33F Virtual Address : 00C9DF3F FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B35A Virtual Address : 00C9DF5A FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B386 Virtual Address : 00C9DF86 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B3BA Virtual Address : 00C9DFBA FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B3E5 Virtual Address : 00C9DFE5 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B40D Virtual Address : 00C9E00D FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B446 Virtual Address : 00C9E046 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B451 Virtual Address : 00C9E051 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B48A Virtual Address : 00C9E08A FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B4C3 Virtual Address : 00C9E0C3 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B506 Virtual Address : 00C9E106 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B514 Virtual Address : 00C9E114 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B53A Virtual Address : 00C9E13A FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B564 Virtual Address : 00C9E164 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B598 Virtual Address : 00C9E198 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B5C8 Virtual Address : 00C9E1C8 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B5EF Virtual Address : 00C9E1EF FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B613 Virtual Address : 00C9E213 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B636 Virtual Address : 00C9E236 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B67D Virtual Address : 00C9E27D FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B6A2 Virtual Address : 00C9E2A2 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B6C7 Virtual Address : 00C9E2C7 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B6F3 Virtual Address : 00C9E2F3 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B72D Virtual Address : 00C9E32D FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B763 Virtual Address : 00C9E363 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B77E Virtual Address : 00C9E37E FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B7AA Virtual Address : 00C9E3AA FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B7DE Virtual Address : 00C9E3DE FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B80B Virtual Address : 00C9E40B FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B816 Virtual Address : 00C9E416 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B85A Virtual Address : 00C9E45A FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B881 Virtual Address : 00C9E481 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B8B4 Virtual Address : 00C9E4B4 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B8DF Virtual Address : 00C9E4DF FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B924 Virtual Address : 00C9E524 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B92F Virtual Address : 00C9E52F FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B952 Virtual Address : 00C9E552 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B98C Virtual Address : 00C9E58C FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B997 Virtual Address : 00C9E597 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B9BC Virtual Address : 00C9E5BC FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089B9E3 Virtual Address : 00C9E5E3 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BA13 Virtual Address : 00C9E613 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BA46 Virtual Address : 00C9E646 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BA5D Virtual Address : 00C9E65D FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BA89 Virtual Address : 00C9E689 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BACF Virtual Address : 00C9E6CF FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BADD Virtual Address : 00C9E6DD FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BB03 Virtual Address : 00C9E703 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BB19 Virtual Address : 00C9E719 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BB42 Virtual Address : 00C9E742 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BB77 Virtual Address : 00C9E777 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BBA8 Virtual Address : 00C9E7A8 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BBDA Virtual Address : 00C9E7DA FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BC14 Virtual Address : 00C9E814 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BC3C Virtual Address : 00C9E83C FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BC91 Virtual Address : 00C9E891 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BC9F Virtual Address : 00C9E89F FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BCC4 Virtual Address : 00C9E8C4 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BCEA Virtual Address : 00C9E8EA FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BD17 Virtual Address : 00C9E917 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BD45 Virtual Address : 00C9E945 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BD50 Virtual Address : 00C9E950 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BD6D Virtual Address : 00C9E96D FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BD8E Virtual Address : 00C9E98E FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BDEA Virtual Address : 00C9E9EA FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BE05 Virtual Address : 00C9EA05 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BE31 Virtual Address : 00C9EA31 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BE53 Virtual Address : 00C9EA53 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BE5E Virtual Address : 00C9EA5E FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BE97 Virtual Address : 00C9EA97 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BEC6 Virtual Address : 00C9EAC6 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BEEC Virtual Address : 00C9EAEC FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BF0D Virtual Address : 00C9EB0D FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BF51 Virtual Address : 00C9EB51 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BF7F Virtual Address : 00C9EB7F FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089BFAF Virtual Address : 00C9EBAF FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C003 Virtual Address : 00C9EC03 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C00E Virtual Address : 00C9EC0E FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C037 Virtual Address : 00C9EC37 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C068 Virtual Address : 00C9EC68 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C089 Virtual Address : 00C9EC89 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C0C5 Virtual Address : 00C9ECC5 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C0DE Virtual Address : 00C9ECDE FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C0FC Virtual Address : 00C9ECFC FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C135 Virtual Address : 00C9ED35 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C187 Virtual Address : 00C9ED87 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C195 Virtual Address : 00C9ED95 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C1BB Virtual Address : 00C9EDBB FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C1CE Virtual Address : 00C9EDCE FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C22C Virtual Address : 00C9EE2C FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C24B Virtual Address : 00C9EE4B FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C27A Virtual Address : 00C9EE7A FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C2A7 Virtual Address : 00C9EEA7 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C2CD Virtual Address : 00C9EECD FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C2EE Virtual Address : 00C9EEEE FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C314 Virtual Address : 00C9EF14 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C336 Virtual Address : 00C9EF36 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C362 Virtual Address : 00C9EF62 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C382 Virtual Address : 00C9EF82 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C3D6 Virtual Address : 00C9EFD6 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C3E1 Virtual Address : 00C9EFE1 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C3EC Virtual Address : 00C9EFEC FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C415 Virtual Address : 00C9F015 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C43E Virtual Address : 00C9F03E FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C46B Virtual Address : 00C9F06B FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C4AD Virtual Address : 00C9F0AD FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C4B8 Virtual Address : 00C9F0B8 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C4DA Virtual Address : 00C9F0DA FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C52B Virtual Address : 00C9F12B FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C536 Virtual Address : 00C9F136 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C563 Virtual Address : 00C9F163 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C589 Virtual Address : 00C9F189 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C5C9 Virtual Address : 00C9F1C9 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C5D4 Virtual Address : 00C9F1D4 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C5F9 Virtual Address : 00C9F1F9 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C634 Virtual Address : 00C9F234 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C66B Virtual Address : 00C9F26B FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C695 Virtual Address : 00C9F295 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C6B4 Virtual Address : 00C9F2B4 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C6DE Virtual Address : 00C9F2DE FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C729 Virtual Address : 00C9F329 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C734 Virtual Address : 00C9F334 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C764 Virtual Address : 00C9F364 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C76F Virtual Address : 00C9F36F FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C794 Virtual Address : 00C9F394 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C811 Virtual Address : 00C9F411 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C81C Virtual Address : 00C9F41C FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C848 Virtual Address : 00C9F448 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C879 Virtual Address : 00C9F479 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C8A2 Virtual Address : 00C9F4A2 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C8C8 Virtual Address : 00C9F4C8 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C907 Virtual Address : 00C9F507 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C912 Virtual Address : 00C9F512 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C941 Virtual Address : 00C9F541 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C975 Virtual Address : 00C9F575 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C980 Virtual Address : 00C9F580 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C9AD Virtual Address : 00C9F5AD FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C9CF Virtual Address : 00C9F5CF FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089C9FB Virtual Address : 00C9F5FB FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089CA29 Virtual Address : 00C9F629 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089CA34 Virtual Address : 00C9F634 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089CA59 Virtual Address : 00C9F659 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089CA9C Virtual Address : 00C9F69C FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Crypto++ Library Offset Address : 0089CAA7 Virtual Address : 00C9F6A7 FCT.Information : Free C++ class library of Cryptographic Schemes Function Name : Zlib Compression Offset Address : 0087EF38 Virtual Address : 00C81B38 FCT.Information : Zlib is a software library used for data compression Function Name : Zlib Compression Offset Address : 0087FAD4 Virtual Address : 00C826D4 FCT.Information : Zlib is a software library used for data compression Function Name : Zlib Compression Offset Address : 0087FAF0 Virtual Address : 00C826F0 FCT.Information : Zlib is a software library used for data compression Function Name : Zlib Compression Offset Address : 0087FB04 Virtual Address : 00C82704 FCT.Information : Zlib is a software library used for data compression Function Name : Zlib Compression Offset Address : 0087FB50 Virtual Address : 00C82750 FCT.Information : Zlib is a software library used for data compression Function Name : Zlib Compression Offset Address : 0087FB68 Virtual Address : 00C82768 FCT.Information : Zlib is a software library used for data compression Function Name : Zlib Compression Offset Address : 0087FB7C Virtual Address : 00C8277C FCT.Information : Zlib is a software library used for data compression Function Name : Zlib Compression Offset Address : 00881318 Virtual Address : 00C83F18 FCT.Information : Zlib is a software library used for data compression Function Name : Zlib Compression Offset Address : 00881324 Virtual Address : 00C83F24 FCT.Information : Zlib is a software library used for data compression Function Name : Zlib Compression Offset Address : 00881498 Virtual Address : 00C84098 FCT.Information : Zlib is a software library used for data compression Function Name : Zlib Compression Offset Address : 0088150C Virtual Address : 00C8410C FCT.Information : Zlib is a software library used for data compression Function Name : Zlib Compression Offset Address : 00881540 Virtual Address : 00C84140 FCT.Information : Zlib is a software library used for data compression Function Name : Zlib Compression Offset Address : 00881568 Virtual Address : 00C84168 FCT.Information : Zlib is a software library used for data compression Function Name : Zlib Compression Offset Address : 008815A0 Virtual Address : 00C841A0 FCT.Information : Zlib is a software library used for data compression Function Name : Zlib Compression Offset Address : 008819E4 Virtual Address : 00C845E4 FCT.Information : Zlib is a software library used for data compression Function Name : Zlib Compression Offset Address : 008819F0 Virtual Address : 00C845F0 FCT.Information : Zlib is a software library used for data compression

This doesn't means that the file is encrypted i just want to share the result with you guys.
If someone want to read something interesting about Encryption or Obfuscating look the attached file.

by **thefiremind** » 02 Dec 2014, 12:40

Here's DotP_D15 passed through a decompiler. If you ask me, it seems even more difficult to read than the disassembled one... but I wanted to share in case someone manages to sort something out of it.
http://www51.zippyshare.com/v/9767918/file.html

By the way, this is my last attempt at doing something: I understood that only a skilled person can progress further, but I don't possess the required skill and I don't want to waste time by trying to acquire it. With much sadness, I give up.

by **Xander9009** » 28 Jan 2015, 23:06

I've posted a request for information or help here. If you (directed at anyone) want, you might go and second the idea of someone experienced trying this. It might convince them if they know there are others that really want this. Unfortunately, the site in general doesn't have a very friendly atmosphere, so we might as well be told to get lost. Fair warning.

by **Zambooo** » 02 Feb 2015, 20:51

Xander9009 wrote:I've posted a request for information or help here. If you (directed at anyone) want, you might go and second the idea of someone experienced trying this. It might convince them if they know there are others that really want this. Unfortunately, the site in general doesn't have a very friendly atmosphere, so we might as well be told to get lost. Fair warning.

I commented that post but it seems like they haven't "authorized" it yet..

by **Xander9009** » 02 Feb 2015, 20:54

Zambooo wrote:I commented that post but it seems like they haven't "authorized" it yet..

I think it took about 6-8 hours for mine originally.

by **logoliv** » 23 Mar 2015, 22:51

Hi all,

I've just posted a request on Zenhax forum here :
http://zenhax.com/viewtopic.php?f=9&t=757
Let's see if they can help

PS : for those of you who don't know this site, it's a great location to find help about file formats, like Xentax.com (but you don't need to pay a membership on Zenhax, it's free)

by **logoliv** » 25 Mar 2015, 00:12

I have an answer from Zenhax site admin, but i can't understand what he found, so if someone could look at what he explained it would be nice and perhaps very useful

by **RiiakShiNal** » 25 Mar 2015, 00:42

I would have to play with the information some to see if I can decode a ZED file, but I basically understand what was said. Most of it is what had been previously discovered (the xor'ing of the file and that it had a PKZip base that had been customized. It doesn't go into much detail on the "scrambling" used on the contained files which may be the killer since we may still not know how to go from the source 256 bytes (0x100 bytes) to the 153 bytes (0x99) for the input to the inflate routine which will give us the 272 bytes (0x110 bytes) of output.

I can try to play around with it some this weekend, but no promises and don't get your hopes up.

by **thefiremind** » 25 Mar 2015, 00:45

I can only add that the "precomp" he wrote about is probably this software, but knowing what it is doesn't give me any further insight about that obscure transformation happening in the ZED files.

by **logoliv** » 25 Mar 2015, 01:06

Ok guys, good to see that you're still there.

I thought that it would be easier to deal with... by the way you could perhaps talk directly with him to decode the scramble algorithm, you clearly have more knowledge on the subject than me !

WoTC has well managed to protect DOTP against modding this time (and i'm sure the upcoming Duels Origins will also use that format) so not much hope to be able to mod again in the future

by **spirolone** » 25 Mar 2015, 15:21

I would have preferred to write again only with some definitive results obtained, but maybe now it can be usefull to share something I'm actually confident about.

DotP_D15.exe reads last 8 bytes of Data_0**.zed file and manipulates them with a xor operation obtaining offset and length of central directory inside archive. It reads it and extracts first 256 bytes that are encrypted, I think, with RSA. Hidden in exe there is public key that is:

Code: Select all: 30 82 01 20 30 0D 06 09 2A 86 48 86 F7 0D 01 01 01 05 00 03 82 01 0D 00 30 82 01 08 02 82 01 01 00 C4 D0 B8 81 9C AB 92 E7 E8 7A 4D 2E 1A 7B 5C 91 1F 1D 7C F1 81 8B C8 B5 CD C9 55 37 4A 01 9E 67 98 4A 3A 26 FE 20 0D 81 87 CE AD EC 56 37 EB C0 09 CA 11 63 CC 50 16 E6 FD 59 A4 77 3D 91 AA 36 12 39 AA 16 46 2C 8A 63 FE 08 67 47 BA D9 7F 76 07 61 9A 4B FA 32 52 72 93 46 39 92 2F 1E C3 E9 4B C5 7E 23 52 C2 C7 75 46 25 54 28 84 FD E9 59 52 70 2A B9 EE 39 EB 4B F9 FB 6D 66 05 55 2C 07 19 03 88 AB D8 E4 9E 04 73 2A 2A A1 B0 07 0A 84 E8 B8 5A 68 48 59 19 B8 B6 6D 5C F5 D1 2A 31 C0 C6 5F 11 C5 69 5A 2B 3B C0 1B 90 38 51 3A 6C EB 47 89 2F 1E 67 9D 2F 7D 6F 1A 30 FE C5 26 C6 BE 19 D2 60 E8 56 8C C9 B2 07 4B 75 9B 47 3B B8 DE 7C FA B3 CC 54 0A 7D 69 34 04 96 B6 5D 45 27 4C 7A 60 2F DA 21 55 AF 24 D8 28 E7 56 EB B8 55 5D 2F 37 9A 57 DC ED 0E E3 BF 6F F8 54 38 90 A4 35 02 01 11

So, modulus n is 0xC4D0B8819CAB92E7E87A4D2E1A7B5C911F1D7CF1818BC8B5CDC955374A019E67984A3A26FE200D8187CEADEC5637EBC009CA1163CC5016E6FD59A4773D91AA361239AA16462C8A63FE086747BAD97F7607619A4BFA325272934639922F1EC3E94BC57E2352C2C7754625542884FDE95952702AB9EE39EB4BF9FB6D6605552C07190388ABD8E49E04732A2AA1B0070A84E8B85A68485919B8B66D5CF5D12A31C0C65F11C5695A2B3BC01B9038513A6CEB47892F1E679D2F7D6F1A30FEC526C6BE19D260E8568CC9B2074B759B473BB8DE7CFAB3CC540A7D69340496B65D45274C7A602FDA2155AF24D828E756EBB8555D2F379A57DCED0EE3BF6FF8543890A435;
and exponent e is 0x11 (this is very uncommon!).
I think decrypted message m is:

Code: Select all: 51 1A 1B 19 26 26 32 32 32 33 33 33 1F 86 D9 9C 9C 9C 9C 9C 9C 9C 9C 9C 9C 9C 9C 9C 96 96 B2 B2 B2 B2 B2 B2 B2 B2 A2 A2 A2 A2 A2 A2 A2 A2 8C C1 84 D0 91 D5 94 C0 81 AE A4 A4 84 84 84 84 84 84 85 85 9D 9D EB 16 C1 EF D1 24 EB EA 9C 61 B6 98 A6 53 9C 9D 52 5A 2A 04 39 CC 03 02 52 19 18 1A 25 25 31 31 31 30 38 38 6A F2 AD E8 77 FE 49 AC 58 A7 A7 A7 49 69 66 66 70 70 54 54 54 54 54 54 54 54 74 74 74 74 74 74 74 74 5A 17 52 06 47 03 42 16 57 78 3E 57 3B 5E 1A 7B 0F 6E 40 38 55 39 33 33 13 13 13 13 13 13 12 12 0A 0A 91 13 79 42 7F 8A 45 44 02 BD D4 EF D2 27 E8 E9 AF 10 79 42 7F 8A 45 44 14 5F 5E 5C 63 63 77 77 77 76 7E 7E 2E B9 E6 A3 33 47

that will become, after final xoring:

Code: Select all: 50 4B 01 02 3F 00 14 00 00 01 00 00 2C 99 5F 45 00 00 00 00 00 00 00 00 00 00 00 00 0A 00 24 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 2E 4D 45 54 41 44 41 54 41 2F 0A 00 20 00 00 00 00 00 01 00 18 00 76 FD D7 2E 3E F5 CF 01 76 FD D7 2E 3E F5 CF 01 CF 08 70 2E 3D F5 CF 01 50 4B 01 02 3F 00 14 00 00 01 08 00 52 98 5F 45 9F 89 B7 E5 F4 FF 00 00 EE 20 0F 00 16 00 24 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 2E 4D 45 54 41 44 41 54 41 2F 46 69 6C 65 44 61 74 61 2E 78 6D 6C 0A 00 20 00 00 00 00 00 01 00 18 00 9B 82 6A 3B 3D F5 CF 01 46 BF 69 3B 3D F5 CF 01 46 BF 69 3B 3D F5 CF 01 50 4B 01 02 3F 00 14 00 00 01 08 00 50 97 5F 45 90 74

It is, then, 214 bytes long.

My problem is that if I compute c^e mod n (c is hex value of original 256 bytes) I obtain a 256-bytes number that don't start with "0x00" as I need to use a EME-OAEP decoding procedure!

However, after it obtains m, program do a xor of any byte in whole central directory with previous one. Every compressed file in archive (there are some little files that are stored as plain text) is at least 256 bytes long and I suppose it has first 256 bytes encrypted in same way as central directory.

by **logoliv** » 25 Mar 2015, 20:13

nicely found spirolone, keep up the good work and perhaps we'll be finally able to mod the game

by **logoliv** » 13 Apr 2015, 17:42

@spirolone : your results were promising, have you made some progress decoding zed files ?

by **spirolone** » 23 May 2015, 08:41

Almost two months has passed since my last post: I'm sorry, I thought it would have been more easy to understand a Zed archive!

But, finally, I think I understood how it works and now I can extract a file from archive!!! :mrgreen:

Information pending...

Re: Information pending...

Re: Information pending...

Re: Information pending...

Re: Information pending...

Re: Information pending...

Re: Information pending...

Re: Information pending...

Re: Information pending...

Re: Information pending...

Re: Information pending...

Re: Information pending...

Re: Information pending...

Re: Information pending...

Re: Information pending...

Re: Information pending...

Who is online

Main Menu

User Menu

Our Partners

Who is online

Who is online

Main Menu

User Menu

Our Partners

Who is online

Login Form