Users browsing this thread: 1 Guest(s)
How do I unpack encrypted image files? Hex Editor identifies it as JFIF
#1
One of the android games I'm unpacking has files with no extension. I inspected with Hex Editor, and I think it identifies the data as JFIF. Not sure what to do with this next. Simply renaming the file extension to JPG or JFIF shows me the image's thumbnail, but I can't open the picture. Image viewers detects the image as corrupted.
Reply
Thanked by: Raccoon Sam
#2
Attach the file here, maybe we can take a look to see what's up!
Once there was a way to get back homeward
Reply
Thanked by:
#3
(08-30-2021, 10:32 AM)Raccoon Sam Wrote: Attach the file here, maybe we can take a look to see what's up!

Here it is. https://www.4shared.com/file/bwpLMwN5iq/...820f3.html
I'm guessing the file is encrypted somehow?
Reply
Thanked by:
#4
normal JPGs start with the bytes:
FF D8 FF E0
your JPG started with the bytes
F1 F6 F4 D7 BE 1C 79 D7 7B F5 ED 5E E1 B7 1B 6F BE 5B 7B 9D 35 F1 CD 5F F1 EE 75 6F 5E 5C FF D8 FF E0
so delete the first thirty and boom it's fixed. see attachment


Attached Files Thumbnail(s)
   
Once there was a way to get back homeward
Reply
Thanked by: otchi
#5
(08-31-2021, 07:01 AM)Raccoon Sam Wrote: normal JPGs start with the bytes:
FF D8 FF E0
your JPG started with the bytes
F1 F6 F4 D7 BE 1C 79 D7 7B F5 ED 5E E1 B7 1B 6F BE 5B 7B 9D 35 F1 CD 5F F1 EE 75 6F 5E 5C FF D8 FF E0
so delete the first thirty and boom it's fixed. see attachment

Oh wow, so it's THAT simple? Just delete everything that comes before FF D8 FF E0?
Thanks so much!
Do I need to rename the file extension to "JPG" too? The file in the game's database has no extensions.
Reply
Thanked by: Raccoon Sam
#6
(08-31-2021, 04:10 PM)otchi Wrote:
(08-31-2021, 07:01 AM)Raccoon Sam Wrote: normal JPGs start with the bytes:
FF D8 FF E0
your JPG started with the bytes
F1 F6 F4 D7 BE 1C 79 D7 7B F5 ED 5E E1 B7 1B 6F BE 5B 7B 9D 35 F1 CD 5F F1 EE 75 6F 5E 5C FF D8 FF E0
so delete the first thirty and boom it's fixed. see attachment

Oh wow, so it's THAT simple? Just delete everything that comes before FF D8 FF E0?
Thanks so much!
Do I need to rename the file extension to "JPG" too? The file in the game's database has no extensions.


Without seeing any other files I can't give any definite answers, as they might be different, but yeah that's pretty much the gist of it. All you need to know is that all valid JPEGs start with "FF D8 FF" and end/terminate with the JPEG trailer, which is "FF D9"
Renaming them to .jpg is wise
Once there was a way to get back homeward
Reply
Thanked by: otchi
#7
(09-01-2021, 01:46 AM)Raccoon Sam Wrote:
(08-31-2021, 04:10 PM)otchi Wrote:
(08-31-2021, 07:01 AM)Raccoon Sam Wrote: normal JPGs start with the bytes:
FF D8 FF E0
your JPG started with the bytes
F1 F6 F4 D7 BE 1C 79 D7 7B F5 ED 5E E1 B7 1B 6F BE 5B 7B 9D 35 F1 CD 5F F1 EE 75 6F 5E 5C FF D8 FF E0
so delete the first thirty and boom it's fixed. see attachment

Oh wow, so it's THAT simple? Just delete everything that comes before FF D8 FF E0?
Thanks so much!
Do I need to rename the file extension to "JPG" too? The file in the game's database has no extensions.


Without seeing any other files I can't give any definite answers, as they might be different, but yeah that's pretty much the gist of it. All you need to know is that all valid JPEGs start with "FF D8 FF" and end/terminate with the JPEG trailer, which is "FF D9"
Renaming them to .jpg is wise

Oh yeah, I managed with the other files. I just wasn't sure what to do with the files detected as JFIFs because the unencrypter program I used didn't do anything with them. 
Thanks again!
Reply
Thanked by: Raccoon Sam


Forum Jump: