how to decrypt and decode png files to real file (.ass)

[Liluy]

New ADN protection.
AES in multibu greatly changed.

[Legremlins_Keitaro]

Nothing change, AES is still the same, no difference between september 2014 multibu and march 2015 multibu in the AES function.

But yes, protection change, and now they can block IP to get subtitle => you can show the video but not the subtitle.

[blurg]

they are another protection inside swf

aes.as (base script)
and aes_constantes.as (new script)

and a few ligne in aes.as script are change
(exemple ligne 147 to 171)

[Liluy]

Yes, if you want to see the difference between the old and the new here.

AES constantes :
package com.longtailvideo.plugins.mulutibu6
{
import mx.core.ByteArrayAsset;

public class AES_Constantes extends ByteArrayAsset
{

public function AES_Constantes()
{
super();
}
}
}

and

public static function d(param1:String, param2:int, param3:int = 63) : String
{

The number after param3: int = changes every day

[KSV]

it was just a minor change in key retrieval. rest of the algorithm is still same. i will push the update to my repository soon.

[KSV]

update pushed to the repository. if they only change third parameter on rotational basis then you can update the $start variable to new one to decrypt successfully. if someone can confirm that they don't change AES constants regularly then script can be further refined to work without requiring any changes at all. i have tested this script on this file.

[Liluy]

Thanks you ! KSV !
It works perfectly !

[blurg]

thx KSV you're the best

but i have just a question about the key in your update script

 $key = substr("eab023e7fdc6e8c6908e116bc550aa7099d46f866436c5a763b0fbfb73a23eceb8d313f7722af47d4530bdbd96d970d8821d0707d284b585ff5"....

how do you have this because the ligne 135 in aes.as change everyday too


03/27/2015 00H20
the new mulutibu swf

doesn't work even when i change $start variable

[KSV]

aes constants are embedded as binary data in swf file. you just have to get the new constants and starting number from updated swf file. i have amended the previous commit so you can directly copy paste that data with minimal changes (replace '0x' with '\x') into script.

[gaaara]

how to get this information automatically with a script ? exemple denobis script

<?php

//get the encryption key
$swf=file_get_contents("mulutibu_v4_3.swf");
$swf        = bin2hex(gzuncompress(substr($swf,8)));
        if (!strpos($swf,"62052404d3a215d3ffff620848")) die("bad");
        
		$iv=explode("24",explode("5620",explode("d030",explode("62052404d3a215d3ffff620848",$swf)[1])[1])[0]);
		
		$key1="";
		
		foreach ($iv as $c)
			{
			$actual=chr(hexdec(substr($c,0,2)));
			$key1.=$actual;
			if (strlen($c)>2)
				$key1.=$actual;							
			}

echo "\r\nivkey:".trim($key1);
        echo "\r\nThe key is in the file adnivkey.txt";
		file_put_contents("adnivkey.txt", trim($key1));

?>

and how to décompile swf files on linux