MisterFister
Valued Member
@MadDancer
I can confirm your Analysis. I inspected the files with tinyHexer. Exactly 30000 Bytes are encrypted, if the file is lagrer than 30000 Bytes. First two Bytes contain the size of the encrypred block, next two Bytes are zero. In my case the size of the file was changed. After the first 30000 encrypted Bytes, the files are the same. But at the end of the encrypted file, there are four Bytes, the original one doesn't have. I could imagine, this is the datee from the beginning of the file, where the size of the encrypted block is located in the encrypted file.
I can confirm your Analysis. I inspected the files with tinyHexer. Exactly 30000 Bytes are encrypted, if the file is lagrer than 30000 Bytes. First two Bytes contain the size of the encrypred block, next two Bytes are zero. In my case the size of the file was changed. After the first 30000 encrypted Bytes, the files are the same. But at the end of the encrypted file, there are four Bytes, the original one doesn't have. I could imagine, this is the datee from the beginning of the file, where the size of the encrypted block is located in the encrypted file.