View Single Post
  #9  
Old 04-05-2020, 19:24
yologuy yologuy is offline
Friend
 
Join Date: Nov 2016
Posts: 18
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 5
Thanks Rcvd at 23 Times in 9 Posts
yologuy Reputation: 0
So it read the last 48bytes Then do a 0x2E xor on it.
hxxps://i.ibb.co/bWtK403/ecrypt-decrypt.jpg

Note that the user_id and the video_id is embedded within the file (also stored at the end of the file)

So here is the data structure starting from the end:
48bytes xored with 0x2E corresponding to the header of the file.
8 null bytes(delimiter?)
UnknowInt32
8 null bytes(delimiter?)
UnknowInt32
UnknowInt32
8 null bytes(delimiter?)
UnknowInt32
video_id (int32)
user_id (int32)
EOF (for the video file)
x bytes[FileContent]
48bytes[] that needs to be replaced by the end bytes xored for the moment they seem to be useless.

So by applying that I was able to retrieve your mp4 files which are from https://fr.tuto.com/after-effects/gratuit-initiation-complete-d-after-effects-after-effects,49795.html (I didn't remove your user_id/video_id)
https://www.sendspace.com/filegroup/RMqSpPbmzMobgzR7U5kRGg


Btw you can get your user_id, just connect to tuto.com, inspect the src code and at the bottom, there is your user_id


Next step create a python script to automate this, but should be trivial will probably have more time next weekend

Enjoy

BTW hxxps://www.relyze.com/beta3.html is amazing and free for non-commercial project

Last edited by yologuy; 04-05-2020 at 19:47.
Reply With Quote