arc-reader icon indicating copy to clipboard operation
arc-reader copied to clipboard

BSE scripts

Open marcussacana opened this issue 10 years ago • 3 comments

You can explain-me more about the BSE Encryption? You say "only first 64 bytes are encrypted" but in the scripts apparently it's encrypted from start at end... for decrypt all script, you can explain how do work de process? ps: i don't know very about C/ASM :/ but you can use small sample in C++.... xor = b ^ 0xFF; xor = xor >> 0x3; for sample....

marcussacana avatar Nov 10 '15 02:11 marcussacana

If you look at https://github.com/minirop/arc-reader/blob/master/bse.c#L32 you'll see that only the 64 first bytes are decrypted.

A simplified example would be: let say you have the number from 0 to 15 with the 5 first numbers encrypted, in the BSE format, you would end up with somthing like 84 66 21 64 77 6 7 8 9 10 11 12 13 14 15

minirop avatar Nov 10 '15 08:11 minirop

hmm. but see this script man http://paste2.org/CnFxxaVC he have compression? it's this? and if have, to i make my own editor, i need change or read this BSE header?

marcussacana avatar Nov 10 '15 14:11 marcussacana

that's because, BSE is an "encryption" over the others. If you decrypt this file, you'll get a (I suppose) a DSC file.

See https://github.com/minirop/arc-reader/blob/master/main.c#L59, I first check if it's BSE encoded, if that's the case then I decrypt the first 64 bytes and then I shift the pointer (line 64) to remove the BSE headers.

minirop avatar Nov 10 '15 16:11 minirop