New FSB Decrypter

[Quidrex]

Without further ado I'd like to present the result of me sitting in front of the computer over the last few days: https://pastebin.com/BFEz1pYd
Yes, it decrypts _preview.fsb.xen files. Yes, it decrypts .fsb.xen files from WoR.

Technical stuff:
While xendecrypt does a known plaintext attack with the 0xFF-padding on the weak FSB encryption algorithm (XOR with 31 byte key), this tool actually computes the key as the original GH executables do, so it can also decrypt the preview files, which typically don't have enough padding. The key depends on the filename, so make sure it's all lowercase. WoR does not use the FSB encryption at all but instead uses one of 256 keys with 128-bit AES in CTR mode. The main key to use is determined by a footer which is always encrypted with the first key. The decrypted footer is output as .fsb.footer if someone wants to look for useful data.

Edit:
You can find the compiled jar at http://www.mediafire.com/file/2gmmq11ck ... ecrypt.jar
Use with: java -jar FsbDecrypt.jar <filenname.fsb.xen>

[bluzer]

Sweeet! Thanks man, guess its time to update the GHWoR files i use.

[Quidrex]

You're welcome. It was overdue for these files to become decryptable :D

[Instrumentallyinsane]

Thanks for making a decrypter for WoR! Works great!