Question

I have a program which stores its keyboard bindings as a large obfuscated or encrypted file. I am trying to find out what type of encryption it is, but am unsure as to where else to explore from here. It's contained in an XML file without any comment or hint (the field name is DeviceIO.Config.Controller)

The whole line is: 
Entry Name="DeviceIO.Config.Controller" Type="3"         Value="RElPTQAA5ipESU9JAAAABAAAAAFERVZTAADmFgAAAAFERVZJAADmCgAAABcAVAByAGEAawB0AG8AcgAuAEsAbwBuAHQAcgBvAGwAIABTADIALgBVAHMAZQByRERBVAAA5dBERElGAAAABAAAAABERElWAAAAGgAAAAkAMgAuADEALgAwACAARABlAHYAAABARERJQwAAAAQAAAAARERQVAAAABoAAAAJAEsAbwBuAHQAcgBvAGwAUwAyAAAAAEREREMAACASRERDSQAAEuQAAABRRENEVAAAACwAAAAKAEwAZQBmAHQALgBTAGgAaQBmAHQAAAABAAAAAD+AAAAAAAADAAAAAERDRFQAAAAuAAAACwBSAGkAZwBoAHQALgBTAGgAaQBmAHQAAAABAAAAAD+AAAAAAAADAAAAAERDRFQAAAAqAAAACQBMAGUAZgB0AC4AUwB5AG4AYwAAAAEAAAAAP4AAAAAAAAMAAAABRENEVAAAACwAAAAKAFIAaQBnAGgAdAAuAFMAeQBuAGMAAAABAAAAAD+AAAAAAAADAAAAAURDRFQAAAAoAAAACABMAGUAZgB0AC4AQwB1AGUAAAABAAAAAD+AAAAAAAADAAAAAkRDRFQAAAAqAAAACQBSAGkAZwBoAHQALgBDAHUAZQAAAAEAAAAAP4AAAAAAAAMAAAACRENEVAAAACoAAAAJAEwAZQBmAHQALgBQAGwAYQB5AAAAAQAAAAA/gAAAAAAAAwAAAANEQ0RUAAAALAAAAAoAUgBpAGcAaAB0AC4AUABsAGEAeQAAAAEAAAAAP4AAAAAAAAMAAAADRENEVAAAADYAAAAPAEwAZQBmAHQALgBIAG8AdABjAHUAZQAuACAAMQAgAAAAAQAAAAA/gAAAAAAAAwAAAAREQ0RUAAAAOAAAABAAUgBpAGcAaAB0AC4ASABvAHQAYwB1AGUALgAgADEAIAAAAAEAAAAAP4AAAAAAAAMAAAAERENEVAAAADYAAAAPAEwAZQBmAHQALgBIAG8AdABjAHUAZQAuACAAMgAgAAAAAQAAAAA/gAAAAAAAAwAAAAVEQ0RUAAAAOAAAABAAUgBpAGcAaAB0AC4ASABvAHQAYwB1AGUALgAgADIAIAAAAAEAAAAAP4AAAAAAAAMAAAAFRENEVAAAADYAAAAPAEwAZQBmAHQALgBIAG8AdABjAHUAZQAuACAAMwAgAAAAAQAAAAA/gAAAAAAAAwAAAAZEQ0RUAAAAOAAAABAAUgBpAGcAaAB0AC4ASABvAHQAYwB1AGUALgAgADMAIAAAAAEAAAAAP4AAAAAAAAMAAAAGRENEVAAAADYAAAAPAEwAZQBmAHQALgBIAG8AdABjAHUAZQAuACAANAAgAAAAAQAAAAA/gAAAAAAAAwAAAAdEQ0RUAAAAOAAAABAAUgBpAGcAaAB0AC4ASABvAHQAYwB1AGUALgAgADQAIAAAAAEAAAAAP4AAAAAAAAMAAAAHRENEVAAAADAAAAAMAEwAZQBmAHQALgBMAG8AbwBwAC4ASQBuAAAAAQAAAAA/gAAAAAAAAwAAAAhEQ0RUAAAAMgAAAA0AUgBpAGcAaAB0AC4ATABvAG8AcAAuAEkAbgAAAAEAAAAAP4AAAAAAAAMAAAAIRENEVAAAADIAAAANAEwAZQBmAHQALgBMAG8AbwBwAC4ATwB1AHQAAAABAAAAAD+AAAAAAAADAAAACURDRFQAAAA0AAAADgBSAGkAZwBoAHQALgBMAG8AbwBwAC4ATwB1AHQAAAABAAAAAD+AAAAAAAADAAAACURDRFQAAAA0AAAADgBMAGUAZgB0AC4ATABvAG8AcAAuAE0AbwB2AGUAAAAFwKAAAECgAAAAAAADAAAACkRDRFQAAAA2AAAADwBSAGkAZwBoAHQALgBMAG8AbwBwAC4ATQBvAHYAZQAAAAXAoAAAQKAAAAAAAAMAAAAKRENEVAAAADgAAAAQAEwAZQBmAHQALgBMAG8AbwBwAC4AQQBjAHQAaQB2AGUAAAABAAAAAD+AAAAAAAADAAAAC0RDRFQAAAA6AAAAEQBSAGkAZwBoAHQALgBMAG8AbwBwAC4AQQBjAHQAaQB2AGUAAAABAAAAAD+AAAAAAAADAAAAC0RDRFQAAAA0AAAADgBMAGUAZgB0AC4ATABvAG8AcAAuAFMAaQB6AGUAAAAFwKAAAECgAAAAAAADAAAADERDRFQAAAA2AAAADwBSAGkAZwBoAHQALgBMAG8AbwBwAC4AUwBpAHoAZQAAAAXAoAAAQKAAAAAAAAMAAAAMRENEVAAAADIAAAANAEwAZQBmAHQALgBMAG8AbwBwAC4AUwBlAHQAAAABAAAAAD+AAAAAAAADAAAADURDRFQAAAA0AAAADgBSAGkAZwBoAHQALgBMAG8AbwBwAC4AUwBlAHQAAAABAAAAAD+AAAAAAAADAAAADURDRFQAAAA4AAAAEABMAGUAZgB0AC4AVABlAG0AcABvACAAUgBlAHMAZQB0AAAAAQAAAAA/gAAAAAAAAwAAAA5EQ0RUAAAAOgAAABEAUgBpAGcAaAB0AC4AVABlAG0AcABvACAAUgBlAHMAZQB0AAAAAQAAAAA/         (edited for brevity...)

Scroll to the right to see the sample. Where can I start? Or failing that, what resources exist for me to have an understanding of how to approach a problem like this?

Was it helpful?

Solution

Check out the end of the text-blob. Does it end with an = (equals sign)? If so, chances are it's a Base64-encoded string, which isn't an encryption as much as it's a way to store binary data in a text-compatible fashion, although I've seen places where it was used as a (very) basic form of obfuscation when what you're storing isn't meant to be secure, as much as just not directly in the spotlight.

Since this seems to be an XML attribute value, it's possible that the data contains characters that aren't XML-friendly (such as ", <, & or others) and the developers decided it was easier to just Base64-encode it all, rather than escaping the invalid XML characters specifically.

It's very easy to reverse, and most programming frameworks have built-in utilties for it. .NET, for instance, has the Convert.FromBase64String() method. I'm guessing it's as easy in other languages.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top