Question

This is my first attempt at reverse engineering, and really, I don’t know how to go about it. I have a procedural kind of mind and no foundation of knowledge on popular encryption methods.

But, it seems to me, if I have the very minimum data in the correct format, and know that there is an occurrence in the data of a certain word, or words, and where that word begins and ends in the data – that I could somehow discover the method of decrypting the entire file.

----- ENCRYPTED -------------------------------------------
HEX     44 5E 12 47 55 5E 53 17 4C 5C 49 4F 4F
ACII    D  ^  ?  G  U  ^  S  ?  L  \  I  O  O
DEC     68 94 63 71 85 94 83 63 76 92 73 79 79 
BIN     01000100 01011110 00111111 01000111 01010101 01011110 01010011 00111111    01001100 01011100 01001001 01001111 01001111
----- DECRYPTED -------------------------------------------
HEX     74 6F 20 74 61 6B 65 20 74 65 73 74 73
ASCII   t  o     t  a  k  e     t  e  s  t  s
DEC     116 111 32 116 97 107 101 32 116 101 115 116 115 
BIN     01110100 01101111 00100000 01110100 01100001 01101011 01100101 00100000 01110100 01100101 01110011 01110100 01110011

This is just a sample of data. I know where the title information starts and ends because I examined two files with different titles – so I know these translate to the correct words – but where do I go from here to identifying the encryption process?

*I know people will ask why: This is from a VCE (exam) file format and I want to translate this into XML or JSON. This would make it easy for me to write a program that compares questions and answers from multiple exam files, append, remove duplicates, and create new ones. *

Answer 1

Try XORing the two strings together. What you get is

HEX     30 31 32 33 34 35 36 37 38 39 3A 3B 3C
ASCII   0  1  2  3  4  5  6  7  8  9  :  ;  <

See a pattern yet?