11-03-2016, 07:16 AM
(This post was last modified: 11-03-2016, 08:06 AM by Raccoon Sam.)
This is an interesting case. puggsoy is right, these are in fact real PNG files but under some obfuscation. For comparison's sake, here's the first 18 bytes of a valid PNG and the ones seen in the game's a11.png:
valid: 89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52 00 00
apk's: 89 50 41 88 0D 0A 15 C5 00 00 0F C2 49 48 4B 9D 00 00
diffs: 00 00 0D 59 00 00 05 BB 00 00 0F B5 00 00 07 4B 00 00
It appears that the first two bytes are okay, then two bytes of strangeness. Then two bytes of okay again, and two bytes screwed up again, etc. etc.
I'm trying to figure something out.
EDIT: the smallest file is arrow_attack.png. Its bytes are as follows (confirmed valid bytes bolded)
00: 89 50 4E 36 0D 0A 1A 7B 00 00 00 7C 49 48 44 23
10: 00 00 00 60 00 00 00 60 01 03 00 71 00 01 A3 A4
20: B9 00 00 71 04 67 41 3C 41 00 00 C0 8F 0B FC 10
30: 05 00 00 71 01 73 52 36 42 00 AE BF 1C E9 00 71
40: 00 03 50 4C 54 45 FF 00 00 19 E2 09 37 00 00 00
50: 0C 49 44 41 54 08 D7 63 60 A0 1C 00 00 00 44 00
60: 01 06 C0 57 A2 00 00 00 00 00 00 00 41 00 00 08
70: 71
I dunno, it has a mangled IHDR chunk header, but the PLTE and IDAT chunk headers are okay. Could be just a coincidence.
I can't find a IEND terminator in any of the PNGs though.
tdlr: they're pngs but they've been run through some kind of an obfuscator.
EDIT2: assets/res/images/icon/story/r10004.PNG is still unobfuscated
SUPER EDIT:
okay, i found strings and files relating to Cocos2D framework in the files. Apparently, someone from China has made a PNG encrypter/decrypter that's compatible with Cocos2D to some extent.
So, I guess they're encrypted with that. Dunno the keys though.
valid: 89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52 00 00
apk's: 89 50 41 88 0D 0A 15 C5 00 00 0F C2 49 48 4B 9D 00 00
diffs: 00 00 0D 59 00 00 05 BB 00 00 0F B5 00 00 07 4B 00 00
It appears that the first two bytes are okay, then two bytes of strangeness. Then two bytes of okay again, and two bytes screwed up again, etc. etc.
I'm trying to figure something out.
EDIT: the smallest file is arrow_attack.png. Its bytes are as follows (confirmed valid bytes bolded)
00: 89 50 4E 36 0D 0A 1A 7B 00 00 00 7C 49 48 44 23
10: 00 00 00 60 00 00 00 60 01 03 00 71 00 01 A3 A4
20: B9 00 00 71 04 67 41 3C 41 00 00 C0 8F 0B FC 10
30: 05 00 00 71 01 73 52 36 42 00 AE BF 1C E9 00 71
40: 00 03 50 4C 54 45 FF 00 00 19 E2 09 37 00 00 00
50: 0C 49 44 41 54 08 D7 63 60 A0 1C 00 00 00 44 00
60: 01 06 C0 57 A2 00 00 00 00 00 00 00 41 00 00 08
70: 71
I dunno, it has a mangled IHDR chunk header, but the PLTE and IDAT chunk headers are okay. Could be just a coincidence.
I can't find a IEND terminator in any of the PNGs though.
tdlr: they're pngs but they've been run through some kind of an obfuscator.
EDIT2: assets/res/images/icon/story/r10004.PNG is still unobfuscated
SUPER EDIT:
okay, i found strings and files relating to Cocos2D framework in the files. Apparently, someone from China has made a PNG encrypter/decrypter that's compatible with Cocos2D to some extent.
So, I guess they're encrypted with that. Dunno the keys though.