Looking to decrypt encrypted application tickets

[ryan1336]

Hi,

I'm looking for help decrypting encrypted application tickets.

Using ValvePython's Steam library (pip install steam)

` data = "CAEQ8IrOxw0YBCA+KnAsX1ZReXWSFz1IHPQ6sBSTBK3hj2co79vrystWUrqUyOz9ueLpMy59R0WAirzid93gVGyT7wb3Ptwmdtqhb+UtqIupxHQ7n5k6HCCAh4Us3jC3a64hhJ9XjEEzorxzciVbSgQmMASYBGCtBjRV7f1R"
data = base64.b64decode(data)
keyx = key.encode()
decrypted_data = crypto.symmetric_decrypt(crypto.pad(data), keyx)

import struct
s = struct.unpack_from("IIQIIIINNhIhhhxx", decrypted_data[:64])`

I wonder if your library can accomplish it instead as I've hit a wall using Py Steam, probably have the struct all wrong. How can I contact you by the way? Do you do consultations?

[Gobot1234]

I have no clue sorry, if you want to get in contact with Rossen, the creator of ValvePython/steam he may be more helpful. https://webchat.freenode.net/#steamkit

We do also have a discord server https://discord.gg/M68WUS

[Gobot1234]

I may have an answer, not too sure if this is what you want

from base64 import b64decode

from steam.protobufs import encrypted_app_ticket_pb2


print(encrypted_app_ticket_pb2.EncryptedAppTicket.FromString(b64decode('CAEQ8IrOxw0YBCA+KnAsX1ZReXWSFz1IHPQ6sBSTBK3hj2co79vrystWUrqUyOz9ueLpMy59R0WAirzid93gVGyT7wb3Ptwmdtqhb+UtqIupxHQ7n5k6HCCAh4Us3jC3a64hhJ9XjEEzorxzciVbSgQmMASYBGCtBjRV7f1R')))

>>> ticket_version_no: 1
... crc_encryptedticket: 3639838064
... cb_encrypteduserdata: 4
... cb_encrypted_appownershipticket: 62
... encrypted_ticket: ",_VQyu\222\027=H\034\364:\260\024\223\004\255\341\217g(\357\333\353\312\313VR\272\224\310\354\375\271\342\3513.}GE\200\212\274\342w\335\340Tl\223\357\006\367>\334&v\332\241o\345-\250\213\251\304t;\237\231:\034 \200\207\205,\3360\267k\256!\204\237W\214A3\242\274sr%[J\004&0\004\230\004`\255\0064U\355\375Q"

[ryan1336]

Yeah, I've got this far as well the problem is the decrypted data, I can't get the struct quite right: decrypted_data = crypto.symmetric_decrypt(test.encrypted_ticket, keyx) if not zlib.crc32(decrypted_data) == test.crc_encryptedticket: return False decrypted_ticket_len = len(test.encrypted_ticket) s = struct.unpack_from("IIllIIINNhIhhh", decrypted_data) print(s)

…

On Wed, Jun 3, 2020 at 6:00 PM James ***@***.***> wrote: I may have an answer, not too sure if this is what you want from base64 import b64decode from steam.protobufs import encrypted_app_ticket_pb2 print(encrypted_app_ticket_pb2.EncryptedAppTicket.FromString(b64decode('CAEQ8IrOxw0YBCA+KnAsX1ZReXWSFz1IHPQ6sBSTBK3hj2co79vrystWUrqUyOz9ueLpMy59R0WAirzid93gVGyT7wb3Ptwmdtqhb+UtqIupxHQ7n5k6HCCAh4Us3jC3a64hhJ9XjEEzorxzciVbSgQmMASYBGCtBjRV7f1R'))) >>> ticket_version_no: 1 ... crc_encryptedticket: 3639838064 ... cb_encrypteduserdata: 4 ... cb_encrypted_appownershipticket: 62 ... encrypted_ticket: ",_VQyu\222\027=H\034\364:\260\024\223\004\255\341\217g(\357\333\353\312\313VR\272\224\310\354\375\271\342\3513.}GE\200\212\274\342w\335\340Tl\223\357\006\367>\334&v\332\241o\345-\250\213\251\304t;\237\231:\034 \200\207\205,\3360\267k\256!\204\237W\214A3\242\274sr%[J\004&0\004\230\004`\255\0064U\355\375Q" — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#9 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AKCOGPQYJIEFP6Z3EJIA66TRUZ6TTANCNFSM4NQKZZBA> .

[Gobot1234]

Structs confuse me so no clue on that front.