冒险解谜游戏中文网 ChinaAVG
标题:
莫克莱特庄园之谜的解开xor加密后的样本
[打印本页]
作者:
shane007
时间:
2011-4-4 06:56
标题:
莫克莱特庄园之谜的解开xor加密后的样本
rt,据说用了lzma压缩，待研究。
; B; a/ r3 c t0 d9 `! q0 a
[attach]19927[/attach]
作者:
shane007
时间:
2011-4-4 09:07
本帖最后由 shane007 于 2011-4-4 09:17 编辑
3 g- |4 s! X6 `6 Z6 ^. A0 h
4 D, t" u& H+ _2 j+ p8 J9 [
F4 00 00 00 00 00 00 00 9A 00 00 00 00 00 00 00 11 C2 18 00 00 00 00 00 01 00 25
% G- R0 Q( ?4 k( p
5D 00 00 00 00 00 00 00 54 00 00 00 00 00 00 00 AB C2 18 00 00 00 00 00 01 00 2C
9 w, C6 ^# d( x
2C 01 00 00 00 00 00 00 FB 00 00 00 00 00 00 00 FF C2 18 00 00 00 00 00 01 00 2F
2 _+ l4 r! J/ I! O; ]- s5 \
24 01 00 00 00 00 00 00 F3 00 00 00 00 00 00 00 FA C3 18 00 00 00 00 00 01 00 2A
4 C: X: w: d m1 j1 \0 z
80 03 00 00 00 00 00 00 52 00 00 00 00 00 00 00 ED C4 18 00 00 00 00 00 01 00 39
2 v( r6 F5 n0 {3 t0 X" s( x+ b4 k$ y
6B 00 00 00 00 00 00 00 65 00 00 00 00 00 00 00 3F C5 18 00 00 00 00 00 01 00 2F
/ o& }& \1 W# M+ b$ R
1 E z5 S) Y; J
初步分析，文件结构如下
" X; I c2 @1 B
filenameLength 2bytes
9 I8 a1 }& J- s/ c& N
filename nbytes
3 O8 R/ C6 i8 B2 `: o. c$ }# \, Z
size 8bytes
7 }, d* f* N- ^1 R8 l
zsize 8bytes
$ E* b/ n" o3 K* H9 _& d# ~$ y
offset 8bytes
$ o+ P" h$ | O% c
flag 1bytes folder:1 file:0
0 C. D3 a& b0 E: f9 d
欢迎光临 冒险解谜游戏中文网 ChinaAVG (https://chinaavg.com/)
Powered by Discuz! X3.2