reverse finds XXTEA encryption keys in ARM64 Android/iOS Cocos apps.

How it works:

• Disassembles ARM64 functions
• Tracks register values and stack objects
• Recognizes std::string patterns (inline and heap)
• Finds calls to XXTEA functions
• Extracts encryption keys and signatures
• Shows annotated assembly code

Special thanks to Taha Draidia for the guidance and feedback that made this proof-of-concept possible.

Demo

TUI:

make
./reverse libcocos2djs.so

No TUI:

./reverse libcocos2djs.so --no-tui

Entry points assembly with annotations

./reverse libcocos2djs.so --no-tui --full

JSON output for scripting

./reverse libcocos2djs.so --json

Encrypt a file with XXTEA:

./reverse --encrypt --key "mykey" file.lua

Encrypt with a signature (prepended to encrypted data):

./reverse --encrypt --key "mykey" --signature "SIG" file.lua

Write encrypted output to file:

./reverse --encrypt --key "mykey" --signature "SIG" -w file.lua
# Creates file.luac (for .lua files)
# Creates file.jsc (for .js files)
# Creates file.encrypted (for other files)

Batch encrypt all .lua files:

find src -name "*.lua" -exec ./reverse --encrypt --key "mykey" --signature "SIG" -w {} \;

Decrypt a file with a known key:

./reverse --decrypt --key "key" encrypted.luac

Decrypt all jsc files in a directory:

find assets -name "*.jsc" -exec ./reverse --decrypt --key "key" -w {} \;
find assets -name "*.js" -exec prettier -w {} \;

Some Cocos2d-x games add a signature to encrypted files :

• The signature appears at the start of the file
• The encrypted data follows the signature
• The tool strips the signature before decrypting

Ref: ResourcesDecode.cpp

Decrypt with signature:

./reverse --decrypt --key "key" --signature "sig" encrypted.luac

Decrypt all files with a specific signature:

./reverse --find-signature "sig" assets/ | \
 while read f; do
 ./reverse --decrypt --key "key" --signature "sig" -w "$f"
 done

Bruteforce key from .rodata section*

Use this when static analysis fails:

./reverse --decrypt -w --bruteforce libcocos2dlua.so encrypted.luac

with signature:

./reverse --decrypt -w --bruteforce --signature "sig" libcocos2dlua.so encrypted.luac

How --bruteforce works:

• Extracts all strings from the .rodata section
• Searches near the signature first (if provided) - much faster
• Tests each string as a key
• Tests shifted versions too (handles offset pointers)
• Detects gzip/zip compression
• Validates results by checking file headers

ARM64 only (no x86 or ARMv7)

Anthony Zboralski @zboralski github.com/zboralski

MIT License - see LICENSE file for details.