VioletWorm - game.exe

Class FCTJQlq

As before, this class does not appear to rely on other classes, so it is a good candidate for analysis. It contains several encoded strings, which can be renamed as before.

The other strings in the module are base64 encoded, but they are also passed as an argument to the method fZ8aUVb31M2Cahmhu5ZI:

1
public static string 8owwMuJjqLlo9pPUhCrsGoogle = Encoding.UTF8.GetString(Convert.FromBase64String(Encoding.UTF8.GetString(Convert.FromBase64String("WkVkT01XWklXbkpSU0ZKdlpFaDRkMkZSUFQwPQ=="))));
2

3
// Token: 0x0400001A RID: 26
4
public static string DQSEYDpOuwltw1eNOARKGoogle = FCTJQlq.fZ8aUVb31M2Cahmhu5ZI(FCTJQlq.8owwMuJjqLlo9pPUhCrsGoogle);

Looking at that method, the code is:

1
public static string fZ8aUVb31M2Cahmhu5ZI(string encryptedText)
2
{
3
    string @string = Encoding.UTF8.GetString(Convert.FromBase64String(Encoding.UTF8.GetString(Convert.FromBase64String("UlZCRlVrZFpiZz09"))));
4
    List<char> list = new List<char>();
5
    int num = 0;
6
    byte[] array = Convert.FromBase64String(encryptedText);
7
    checked
8
    {
9
        foreach (byte b in array)
10
        {
11
            char c = Strings.Chr((int)((byte)((int)b ^ Strings.Asc(@string[num]))));
12
            list.Add(c);
13
            num = (num + 1) % @string.Length;
14
        }
15
        return new string(list.ToArray());
16
    }
17
}

It starts by creating a variable called string, which is the double decoded value of UlZCRlVrZFpiZz09. It then decodes the argument it received, and for each of the bytes in the decoded string it converts the byte to a number and XORs it with the integer value of the character at the index of the current iteration. For example, if the content of string is abcdef and the content of encryptedText is moise, then on the first iteration, where num is 0, it takes a, converts it to an integer (97) and XORs it with the integer of m (109). The result is added to list and num gets incremented by 1.

The instruction:

1
num = (num + 1) % @string.Length;

This increments num while also keeping it inside the bounds of string. If the input string is 30 characters long while string is 10 characters long, at the 11th iteration there would be no characters left to extract from string, resulting in an index error. Using the modulo operator (%), num always grows up to the length of string and then restarts from 0.

To get the strings without executing the code, we can run them through the following script:

1
import base64
2
import sys
3

4

5
def decrypt(encoded_constant: str) -> str:
6
    key = base64.b64decode(base64.b64decode("UlZCRlVrZFpiZz09").decode("utf-8")).decode(
7
        "utf-8"
8
    )
9

10
    encrypted_text = base64.b64decode(
11
        base64.b64decode(encoded_constant).decode("utf-8")
12
    ).decode("utf-8")
13

14
    encrypted_bytes = base64.b64decode(encrypted_text)
15

16
    result = []
17
    key_index = 0
18

19
    for b in encrypted_bytes:
20
        result.append(chr(b ^ ord(key[key_index])))
21
        key_index = (key_index + 1) % len(key)
22

23
    return "".join(result)
24

25

26
def main() -> None:
27
    encoded_constant = sys.argv[1]
28
    result = decrypt(encoded_constant)
29

30
    print(result)
31

32

33
if __name__ == "__main__":
34
    main()

The script is a direct translation of fZ8aUVb31M2Cahmhu5ZI, with the two decoding steps of the field initializer folded into it so that a base64 literal can be copied straight out of the decompiled source and passed on the command line.

decrypt starts by rebuilding the key: UlZCRlVrZFpiZz09 decoded twice from base64 gives EPERGYn, the seven character key used for every constant in the class. The argument then goes through the same two decodes, which is what the field initializer does before calling the method, followed by a third one, which is the Convert.FromBase64String(encryptedText) inside the method itself. Three decodes in total, and only then is there anything to XOR.

The loop is the foreach from the C#: every byte is XORed with the key character at key_index, and key_index = (key_index + 1) % len(key) is the same wrap-around described above, so a seven byte key covers an input of any length. Running it against the first constant of the table returns the IP address:

1
$ python3 string_decryptor.py WkVkT01XWklXbkpSU0ZKdlpFaDRkMkZSUFQwPQ==
2
130.12.181.70

This allows us to understand the content of some variables:

The assumption that 7000 is a port number is based on the previous variable being an IP address; if it turns out not to be used as a port number, it can be renamed.

So for now the function has been renamed to stringDecryptor and the class to EncodedConstants.

The longer strings do not appear to be passed to the stringDecryptor function. Decoding them with Base64 twice returns another very long string that does not look like Base64 either. For now, they can be skipped while their usage is investigated.