06 Text Deobfuscator

Depending on the development systems used, texts can also be encrypted. Currently, two different encryption methods are used:

  • a complex substitution/transposition cipher – Urwigo
  • a simple substitution/transposition cipher – Earwigo Web Builder and Wherigo Kit respectively.

Urwigo

In a LUA file, the following LUA code is found for an input. However, the text that belongs to the input is encrypted:

function _WKlqK:OnGetInput(input)
  if input == nil then
    input = ""
  end
  if _Urwigo.Hash(string.lower(input)) == 13166 then
    _lj9.Visible = false
    _lj9:MoveTo(nil)
    _WlWcy.Visible = true
    Wherigo.ShowScreen(Wherigo.MAINSCREEN)
  else
    _Urwigo.MessageBox({
      Text = _czTN(")^:w^FF:w\tFl\t:c^m:!S\v^\127Y:F^S\vx:a^!:w\t\127:3\v\tY:gB:wd\127:9\t!^9<:\v^<+"),
      Callback = function(action)
        if action ~= nil then
          Wherigo.ShowScreen(Wherigo.MAINSCREEN)
        end
      end
    })
  end
end

For decryption a table “dtable” is needed, which is located at the very beginning of the LUA file:

dtable = "x%\006QF6MLe\022hA)J7o_+\021VK}\n\0162\029\0009$<H\005s0pG\0268T?N-!Z\027D\001]b\019C3(.q~g ;tOB\024/{u>v|nyX\t\0205^[\f41=&c\015I:\004\rf\018S\017\031a@#w\030mi\"\002zU'\014\bkl\\\023\028\003\a`Y*Wd,ER\vPj\025r"

Earwigo

In a LUA file, the following LUA code is found for an input. However, the text that belongs to the input is encrypted:

function zinputInput1:OnGetInput(input)

  if Wherigo.NoCaseEquals(input, gsub_wig("yyponml")) then
    Wherigo.MessageBox({
      Text = gsub_wig("8Qh jMc iYRVgURv21") .. "<BR>\n" .. 
             gsub_wig("NUXhRd QVXigyxw"),

      Media = zmedia7404907b588e464d96fe70c0c512fbed,
      Callback = cartStetsgernfuerSiebesch.MsgBoxCBFuncs.MsgBoxCB6

    })
  else

    Wherigo.MessageBox({

      Text = gsub_wig("CUXRRd PRbhQUxwv") .. "<BR>\n" .. "<BR>\n" ..
             gsub_wig("GhdPVQc Vi kRUeOi10z"),

      Media = zmediadb646ac9929941db8aeb8679f3df73de,

      Callback = cartStetsgernfuerSiebesch.MsgBoxCBFuncs.MsgBoxCB5
    })
  end
end

For decryption a table “rotate_table” is needed, which is located at the very end of the LUA file. But because it is an easy obfusctation, this table is not cartridge specific.