// Dll : mscorlib.dll
// Namespace: System.Security.Cryptography
public sealed class RijndaelManagedTransform : ICryptoTransform, IDisposable
{
// Fields
private CipherMode m_cipherMode; // 0x10
private PaddingMode m_paddingValue; // 0x14
private RijndaelManagedTransformMode m_transformMode; // 0x18
private Int32 m_blockSizeBits; // 0x1c
private Int32 m_blockSizeBytes; // 0x20
private Int32 m_inputBlockSize; // 0x24
private Int32 m_outputBlockSize; // 0x28
private Int32[] m_encryptKeyExpansion; // 0x30
private Int32[] m_decryptKeyExpansion; // 0x38
private Int32 m_Nr; // 0x40
private Int32 m_Nb; // 0x44
private Int32 m_Nk; // 0x48
private Int32[] m_encryptindex; // 0x50
private Int32[] m_decryptindex; // 0x58
private Int32[] m_IV; // 0x60
private Int32[] m_lastBlockBuffer; // 0x68
private Byte[] m_depadBuffer; // 0x70
private Byte[] m_shiftRegister; // 0x78
private static readonly Byte[] s_Sbox; // 0x0
private static readonly Int32[] s_Rcon; // 0x8
private static readonly Int32[] s_T; // 0x10
private static readonly Int32[] s_TF; // 0x18
private static readonly Int32[] s_iT; // 0x20
private static readonly Int32[] s_iTF; // 0x28
// Properties
public Int32 InputBlockSize { get; }
public Int32 OutputBlockSize { get; }
public Boolean CanTransformMultipleBlocks { get; }
// Methods
// RVA: 0x1a91734 VA: 0x7859f53734
internal Void .ctor(Byte[] rgbKey, CipherMode mode, Byte[] rgbIV, Int32 blockSize, Int32 feedbackSize, PaddingMode PaddingValue, RijndaelManagedTransformMode transformMode) { }
// RVA: 0x1a92324 VA: 0x7859f54324
public Void Dispose() { }
// RVA: 0x1a9232c VA: 0x7859f5432c
private Void Dispose(Boolean disposing) { }
// RVA: 0x1a923f4 VA: 0x7859f543f4
public Int32 get_InputBlockSize() { }
// RVA: 0x1a923fc VA: 0x7859f543fc
public Int32 get_OutputBlockSize() { }
// RVA: 0x1a92404 VA: 0x7859f54404
public Boolean get_CanTransformMultipleBlocks() { }
// RVA: 0x1a9240c VA: 0x7859f5440c
public Int32 TransformBlock(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount, Byte[] outputBuffer, Int32 outputOffset) { }
// RVA: 0x1a93c80 VA: 0x7859f55c80
public Byte[] TransformFinalBlock(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount) { }
// RVA: 0x1a93f54 VA: 0x7859f55f54
public Void Reset() { }
// RVA: 0x1a926d8 VA: 0x7859f546d8
private Int32 EncryptData(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount, ref Byte[] outputBuffer, Int32 outputOffset, PaddingMode paddingMode, Boolean fLast) { }
// RVA: 0x1a93210 VA: 0x7859f55210
private Int32 DecryptData(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount, ref Byte[] outputBuffer, Int32 outputOffset, PaddingMode paddingMode, Boolean fLast) { }
// RVA: 0x1a93fcc VA: 0x7859f55fcc
private Void Enc(Int32* encryptindex, Int32* encryptKeyExpansion, Int32* T, Int32* TF, Int32* work, Int32* temp) { }
// RVA: 0x1a94188 VA: 0x7859f56188
private Void Dec(Int32* decryptindex, Int32* decryptKeyExpansion, Int32* iT, Int32* iTF, Int32* work, Int32* temp) { }
// RVA: 0x1a91d68 VA: 0x7859f53d68
private Void GenerateKeyExpansion(Byte[] rgbKey) { }
// RVA: 0x1a94464 VA: 0x7859f56464
private static Int32 rot1(Int32 val) { }
// RVA: 0x1a9445c VA: 0x7859f5645c
private static Int32 rot2(Int32 val) { }
// RVA: 0x1a94358 VA: 0x7859f56358
private static Int32 rot3(Int32 val) { }
// RVA: 0x1a94360 VA: 0x7859f56360
private static Int32 SubWord(Int32 a) { }
// RVA: 0x1a94438 VA: 0x7859f56438
private static Int32 MulX(Int32 x) { }
// RVA: 0x1a9446c VA: 0x7859f5646c
private static Void .cctor() { }
}
well idk , maybe try ida. sorryThank you very much for this software proposal, it is indeed very complete but unfortunately it does not show me the code that could help me decrypt my files (which are out of apk)
View attachment 498217
All .cs files have no code.
I also tried to decrypt my files directly with the software but it does not seem to have this possibility.
Surely this would have worked if the files weren't separated from the apk and if it wasn't encrypted.
I redid research in the dump.cs that I had been able to extract, I think that the function which decrypts the files in the memory is in there:
C#:// Dll : mscorlib.dll // Namespace: System.Security.Cryptography public sealed class RijndaelManagedTransform : ICryptoTransform, IDisposable { // Fields private CipherMode m_cipherMode; // 0x10 private PaddingMode m_paddingValue; // 0x14 private RijndaelManagedTransformMode m_transformMode; // 0x18 private Int32 m_blockSizeBits; // 0x1c private Int32 m_blockSizeBytes; // 0x20 private Int32 m_inputBlockSize; // 0x24 private Int32 m_outputBlockSize; // 0x28 private Int32[] m_encryptKeyExpansion; // 0x30 private Int32[] m_decryptKeyExpansion; // 0x38 private Int32 m_Nr; // 0x40 private Int32 m_Nb; // 0x44 private Int32 m_Nk; // 0x48 private Int32[] m_encryptindex; // 0x50 private Int32[] m_decryptindex; // 0x58 private Int32[] m_IV; // 0x60 private Int32[] m_lastBlockBuffer; // 0x68 private Byte[] m_depadBuffer; // 0x70 private Byte[] m_shiftRegister; // 0x78 private static readonly Byte[] s_Sbox; // 0x0 private static readonly Int32[] s_Rcon; // 0x8 private static readonly Int32[] s_T; // 0x10 private static readonly Int32[] s_TF; // 0x18 private static readonly Int32[] s_iT; // 0x20 private static readonly Int32[] s_iTF; // 0x28 // Properties public Int32 InputBlockSize { get; } public Int32 OutputBlockSize { get; } public Boolean CanTransformMultipleBlocks { get; } // Methods // RVA: 0x1a91734 VA: 0x7859f53734 internal Void .ctor(Byte[] rgbKey, CipherMode mode, Byte[] rgbIV, Int32 blockSize, Int32 feedbackSize, PaddingMode PaddingValue, RijndaelManagedTransformMode transformMode) { } // RVA: 0x1a92324 VA: 0x7859f54324 public Void Dispose() { } // RVA: 0x1a9232c VA: 0x7859f5432c private Void Dispose(Boolean disposing) { } // RVA: 0x1a923f4 VA: 0x7859f543f4 public Int32 get_InputBlockSize() { } // RVA: 0x1a923fc VA: 0x7859f543fc public Int32 get_OutputBlockSize() { } // RVA: 0x1a92404 VA: 0x7859f54404 public Boolean get_CanTransformMultipleBlocks() { } // RVA: 0x1a9240c VA: 0x7859f5440c public Int32 TransformBlock(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount, Byte[] outputBuffer, Int32 outputOffset) { } // RVA: 0x1a93c80 VA: 0x7859f55c80 public Byte[] TransformFinalBlock(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount) { } // RVA: 0x1a93f54 VA: 0x7859f55f54 public Void Reset() { } // RVA: 0x1a926d8 VA: 0x7859f546d8 private Int32 EncryptData(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount, ref Byte[] outputBuffer, Int32 outputOffset, PaddingMode paddingMode, Boolean fLast) { } // RVA: 0x1a93210 VA: 0x7859f55210 private Int32 DecryptData(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount, ref Byte[] outputBuffer, Int32 outputOffset, PaddingMode paddingMode, Boolean fLast) { } // RVA: 0x1a93fcc VA: 0x7859f55fcc private Void Enc(Int32* encryptindex, Int32* encryptKeyExpansion, Int32* T, Int32* TF, Int32* work, Int32* temp) { } // RVA: 0x1a94188 VA: 0x7859f56188 private Void Dec(Int32* decryptindex, Int32* decryptKeyExpansion, Int32* iT, Int32* iTF, Int32* work, Int32* temp) { } // RVA: 0x1a91d68 VA: 0x7859f53d68 private Void GenerateKeyExpansion(Byte[] rgbKey) { } // RVA: 0x1a94464 VA: 0x7859f56464 private static Int32 rot1(Int32 val) { } // RVA: 0x1a9445c VA: 0x7859f5645c private static Int32 rot2(Int32 val) { } // RVA: 0x1a94358 VA: 0x7859f56358 private static Int32 rot3(Int32 val) { } // RVA: 0x1a94360 VA: 0x7859f56360 private static Int32 SubWord(Int32 a) { } // RVA: 0x1a94438 VA: 0x7859f56438 private static Int32 MulX(Int32 x) { } // RVA: 0x1a9446c VA: 0x7859f5646c private static Void .cctor() { } }
I would just need the possibility of finding the code which is in these functions and I could perhaps find the algorithm which is carried out, do you have a software which would allow me this?
okyes I solved my problem in another way, you can close this thread thank you
We use cookies to personalize content and ads, to provide social media features and to analyse our traffic. We also share necessary information with our advertising and analytics partners to optimize your experience on our site.
Learn more about cookies
We use cookies to personalize content and ads, to provide social media features and to analyse our traffic. We also share necessary information with our advertising and analytics partners to optimize your experience on our site.
Learn more about cookies