Skip to main content

Obfuscation: Constant (C-String)

R5AC uses a simple XOR algorithm where the decryption key length and encrypted content length are identical.

 

Referenced & encoded C-Strings Analysis

 

0x20ea35 KERNEL32.dll
0x3a3e51 ntdll.dll
0x54ee61 ADVAPI32.dll
0x542551 steamnetworkingsockets.dll
0x542691 steam_api64.dll
0x2f1cc2 EOSSDK-Win64-Shipping.dll
0x54ee31 EasyAntiCheat_EOS
0x3a3e81 wine_get_version

 

0x20ea60 K32GetMappedFileNameA
0x20ee00 VirtualQuery
0x20f160 GetLastError
0x7df831 VirtualProtect
0x54ee91 OpenSCManagerA
0x54eec1 OpenServiceA
0x54eef1 QueryServiceStatusEx
0x54ef21 CloseServiceHandle
0x543471 WideCharToMultiByte
0x541fc0 RtlCaptureStackBackTrace