Decrypting APK's + other stuff :)

[is0-mick]

Hi All,
Anyone with a max and adb access ? can you check /mnt/.cci folder (I found some games in this folder)

There should be some shortcut's in there with a long string (base64 encoded)

if you can try the following...
(note the string will be different for each apk)
it will look something like V6SZ4Z+m5iQmx4H9wHG9ZamHJ3ag6J=
insert the string in the command below but keep the .ita at the end.
cp /mnt.../insert string here.ita /sdcard/output.apk

When complete, you should have a decrypted apk called output.apk in your sd card.

This also works for .vpv (video) and vpm (music) files but you need to supply the encrypted path of the file after the /mnt/.../ which you probably wont be able to generate at the moment unless you can program java (android). I've got some code working and to do other stuff, but its still being worked on at the moment.

If anyone wants to have a try, check out VDM.apk or VPM.apk and use the crypath class example below.

String encrypted = CryPath.x("/sdcard/LLN/57-126803-200-060_body_e933054d33e1bda7a40950e701380ebc.vpv");

the returned string can then be used like
cp /mnt/.../(encrypted string) /sdcard/outputfile.avi



The path /mnt/... is a fuse filesystem which is actually the decrypter. This is created by the jd.x file (which actually processes the decryption).

Please post below how you get on.

I also noticed that when you insert a cartridge. The max version is downloaded to the device.
The tablet I have has 3 cartridges installed, which I managed to run via the main android application screen without the actually having the cartridges.


Mick

[Coley2930]

This should be pinned.. I can't believe no one has replied? Everyone wants a hack but where are they when you need them :?

I have 2 innotab max's (pink an a blue one) an some cartridges for older innotab's that fit the max, I will look into this an return, if I can get some free time with the tabs without the kids moaning about it xD.

Base64 is quit simple, I know it from using it with php :-)

Code:

U3BpZmZ5IEhhY2tzIFJ1bGVzIA==

[is0-mick]

Pinned as requested.

Mick

[kyou007]

Hi everybody,

Sorry for my english (i m french)

1) I did not understand the step to decrypt .ita to .apk

i have found in app private a shortcut like /mnt/.../QStlmidwVcF+IdeEpC054LDbv3aU4lrzv+3ftPUmGhNJi4RSl+W5nHL6c37Zhi4u.ita (the string?)

Where do i put
"insert the string in the command below but keep the .ita at the end.
cp /mnt.../insert string here.ita /sdcard/output.apk"
In cmd ? (i have tried but cp it is not recognized)

2) How do i use this ?
String encrypted = CryPath.x("/sdcard/LLN/57-126803-200-060_body_e933054d33e1bda7a40950e701380ebc.vpv");
did i need a software ?

3) I have also some .bin, can i with this methode decrypte them in .apk ?

Thanks

[is0-mick]

You do the commands in the adb shell.
So, in cmd on your pc, go to your directory where adb.exe is located.
adb connect
adb shell

and for example:
type at the prompt (should look something a bit like this root@root:/# )

cp /mnt/.../QStlmidwVcF+IdeEpC054LDbv3aU4lrzv+3ftPUmGhNJi4RSl+W5nHL6c37Zhi4u.ita /sdcard/game1.apk

Mick

[kyou007]

You do the commands in the adb shell.
So, in cmd on your pc, go to your directory where adb.exe is located.
adb connect
adb shell

and for example:
type at the prompt (should look something a bit like this root@root:/# )

cp /mnt/.../QStlmidwVcF+IdeEpC054LDbv3aU4lrzv+3ftPUmGhNJi4RSl+W5nHL6c37Zhi4u.ita /sdcard/game1.apk

Mick

Thanks it's working.

But if i have .ita from cartbridge whitout the string, is it possible to decrypt ?

[kyou007]

Hi,

Is it possible to decrypt .bin to .ita or .apk ?

on my fakeapp.db, i see on downloaded cartridge that the Innotab dowload .bin and install a .ita
exemple :
http://contentcdn.vtechda.com/Data/Store...86eb70.bin
/mnt/.cci/8A-126805-000-056_!itmax!_body_94b727f8e9e5dffc09f72ae09f86eb70.ita

So i conclued that innotabMax convert or decrypt .bin to .ita

Any idea how ?

[is0-mick]

The .bin .ita = same file just renamed.
It's just got a different extension.. That's all.

Mick

[Adderly]

old thread, but the instruction from is0-mick is also working on my "Storio Max 2.0"  (Storio is the name for innotab here in germany).
I found the "string" to copy in data/app-private/  after a catridges is inserted und the game downloaded from the vtech server.

cp /mnt/.../"string".ita /mnt/external_sd/"output".apk
works for me.

a ripped cart as .apk file needs to be put into the fakeapp.db to add the game to the game-shelf on the kiddy-launcher