Mp4 wont play in any software except with a chinese app

[bladerelic]

quick story: a restaurant hired me to do computer repair for their "display wall" (multiple projectors pointed at a wall to display random videos). whoever they purchased this system from must have bought it from aliexpress or something because all the software is in chinese, windows activation was hacked, and updates is disabled so its running an old version of windows 10. i cant upgrade windows because the video software doesn't work with newer versions.

i told the customer that i could take all the mp4s and use something like VLC to play the files. thats when i found out that the majority of the files will not play. i've tried several data recovery programs and done some research... which led me to using a hex editor to look at the files. this is where it gets interesting. the hex of a mp4 is supposed to start with "00 00 00 C4" (correct me if im wrong). i have included two files, the C05S40001 file hex starts with "54 54 54 74" and the C23S30001 starts with "2B 2B 2B 0B". wrong bits, but seem to have a similar pattern.

is there some sort of encryption on these files? is there any other software that can play/repair/decode these files? is this a lost cause and i should give up? lol let me know.

[ProWo]

Whats the problem with the running system?
Does the chinese videoplayer play this two mp4?
I think the videos are encrypted.

[Swedaniel]

quick story: a restaurant hired me to do computer repair for their "display wall" (multiple projectors pointed at a wall to display random videos). whoever they purchased this system from must have bought it from aliexpress or something because all the software is in chinese, windows activation was hacked, and updates is disabled so its running an old version of windows 10. i cant upgrade windows because the video software doesn't work with newer versions.

i told the customer that i could take all the mp4s and use something like VLC to play the files. thats when i found out that the majority of the files will not play. i've tried several data recovery programs and done some research... which led me to using a hex editor to look at the files. this is where it gets interesting. the hex of a mp4 is supposed to start with "00 00 00 C4" (correct me if im wrong). i have included two files, the C05S40001 file hex starts with "54 54 54 74" and the C23S30001 starts with "2B 2B 2B 0B". wrong bits, but seem to have a similar pattern.

is there some sort of encryption on these files? is there any other software that can play/repair/decode these files? is this a lost cause and i should give up? lol let me know.

If it is an company the owners have probably purchased an security solution for theese files to not function as ordinary files, probably the owner is looking to fix their videos to only function with their computer system and only their own video players, if they get stolen, no one can use them, if the employees would "illegaly" go against the company/owner probably the goal is for no other video to function then the owners/companys approved videos, could be the case theyre testing your knowledge about theese things before deciding to proceed with big purchase! Atleast since imo it is easy to understand that the company/owner would want such an thing and likely the employees might not want to! maybe theyre encrypted or some other solution, maybe theyre looking for an better one!

Edit: I dont think it is intended to work any other way, if it is the employees calling you asking to unlock things and remove the security, maybe the owners of the company think you should call the police or commit to actions to enhance the security or stop their actions against the company security solutions, atleast if you want to keep them as customers and not bring black dust on your own name!

[Quint]

i cant upgrade windows because the video software doesn't work with newer versions.

In which way? And how did you find that out?

[bladerelic]

i cant upgrade windows because the video software doesn't work with newer versions.

In which way? And how did you find that out?

because i upgraded windows. but thankfully i made a system image first so i could restore everything

[bladerelic]

Whats the problem with the running system?
Does the chinese videoplayer play this two mp4?
I think the videos are encrypted.

yes. the player plays these two files just fine. it actually plays any mp4 i throw at it. i thought it was a codec issue at first.

[bladerelic]

by the way, the software is called XVIEW. it looks to be a program used in karaoke rooms where you can select videos to play. i will try to provide more info about the software later tonight after work. keep the questions coming

[jan5678]

I downloaded the first sample, mediainfo is blank on that and mkvtoolnix won't open it.
So or it is not a video or encrypted i guess?

[ProWo]

You could try this player
https://tdj.com.au/firmware/XVIEW/XV20DVR/ALTERNATIVE%20PC,MAC%20GPS%20PLAYER/

[Quint]

i cant upgrade windows because the video software doesn't work with newer versions.

In which way? And how did you find that out?

because i upgraded windows. but thankfully i made a system image first so i could restore everything

I see... In which way does the software not run? Did you try compatibility options? There was also a "Microsoft compatibility kit" (ACT), where you could try hundreds of options. I could run more than one old software by finding the right options with trial and error. But that was quite a time ago - not sure if this exists and works with Windows 10 (11).

[bladerelic]

i cant upgrade windows because the video software doesn't work with newer versions.

In which way? And how did you find that out?

because i upgraded windows. but thankfully i made a system image first so i could restore everything

I see... In which way does the software not run? Did you try compatibility options? There was also a "Microsoft compatibility kit" (ACT), where you could try hundreds of options. I could run more than one old software by finding the right options with trial and error. But that was quite a time ago - not sure if this exists and works with Windows 10 (11).

i played with the software a little bit more today. here's more info... the XVIEW software is part of a suite of programs used for those karaoke rooms that you can rent out by the hour. another part of that software is the database that keeps track of file names, descriptions, and whatnot. the database runs off of some version of microsoft mysql server that only runs in an older version of windows 10. if i update windows, there is an error about running SQLUNIRL.dll.

[Attachment 76046 - Click to enlarge]

if i run the ViewPlayer.exe file, i get the "class not registered". i've tried manually registering all the dll files with no luck

[bladerelic]

i just happened to find two of the same files- one that works and one that doesn't. fair warning, the files are about 500mb in size. here's the working one

[bladerelic]

and here's the nonworking "encrypted" one. anyone want to take a look and compare both files?

[Quint]

...
the database runs off of some version of microsoft mysql server that only runs in an older version of windows 10. if i update windows, there is an error about running SQLUNIRL.dll.

I see. There are some versions of SQL-Server that can run under Windows 11, some not. You could try to find out and install the last service packs / updates for MSSQL, but you first have to find out the actual version - maybe you can see it simply in the dll's properties? But chances seem low anyway.

The not-working file seems totally encrypted, in some proprietary way, I don't think you have a chance to decrypt somehow.

[Quint]

Correction: The "encryption" seems very simple. It seems, each Byte is only replaced by another, but constantly. So you have to find out by your two files which byte is replaced by which, and write a little programm to re-replace. Good luck!

[bladerelic]

Correction: The "encryption" seems very simple. It seems, each Byte is only replaced by another, but constantly. So you have to find out by your two files which byte is replaced by which, and write a little programm to re-replace. Good luck!

that's what i thought! i was looking up "bit shifting" but i dont think that's what it is called.

[jagabo]

Each byte of the original file was XOR'd with 0x3B to produce the "encrypted" file. You can restore the original by XORing again with 0x3B.

[jagabo]

Here's a simple C program that can decrypt the encrypted file in post #13.

#include <sys\types.h>
#include <sys\stat.h>
#include <io.h>
#include <stdlib.h>
#include <stdio.h>
#include <fcntl.h>
#include <string.h>

#define BUFSIZE (1024*1024)

unsigned char inbuf[BUFSIZE];

/************************************************************************/

int main(int argc, char **argv)
{
	int infd, outfd;
	int inlen;

	infd = _open(argv[1], _O_RDONLY | _O_BINARY);
	if (infd < 0)
	{
		fprintf(stderr, "Error opening input file (%s)!\n", argv[1]);
		exit(1);
	}
	_lseek(infd, 0, SEEK_SET);

	outfd = _open(argv[2], _O_CREAT | _O_WRONLY | _O_BINARY | _O_TRUNC, _S_IREAD | _S_IWRITE);
	if (outfd == -1)
	{
		fprintf(stderr, "Error opening output file (%s)!\n", argv[2]);
		_close(infd);
		return(1);
	}

	while(1)
	{
		inlen = _read(infd, inbuf, sizeof(inbuf));	// read in an encrypted block
		if (inlen <= 0)
			break;

		for (int i=0; i<inlen; i++)
		{
			inbuf[i] = inbuf[i] ^ 0x3b; // decrypt each byte of the block
		}
		
		_write(outfd, inbuf, inlen);	// write out the decrypted block
	}

	_close(infd);
	_close(outfd);
	exit(0);
}

/************************************************************************/

Command line usage: Decrypt EncryptedInput.mp4 DecryptedOutput.mp4

Win64 CLI build from Pelles C attached.

Update: attachment deleted. See the updated version in posts #26 and #28.

[ProWo]

Thanks to Jagabo's excellent analysis, I have written a small portable program that can be used to decrypt your videos.
The app reads the first byte of the encrypted file (e.g. 3B as in Jagabo). Since we know that the original file has 00 as the first byte, 3B is the key for this file.
All bytes are then XORed, which can take longer for long video files. The output file is then decrypted and freely available.

However, if the original file does not start with 00 (e.g. an mkv file, then the key must be determined by XORing the first byte of the encrypted file e.g. 54 with the correct byte e.g. 01, in this case 55.
You can use an onlile calculator for that. https://xor.pw/#

It may be that my program is detected as a virus; I assure you that this is wrong. Of course, both the name and the byte manipulation are suspicious for virus scanners, but the program is clean.

I also used it to decrypt and attach one of your little videos from above.

NB
You can also encrypt any file (picture, video, documents etc), but remember the key or the files are lost.


[Attachment 76128 - Click to enlarge]

[jagabo]

Did the other files require something other than 0x3B? I thought about using the first byte of the file as the key since MP4 files always start with a zero. But when I've encountered this type of encryption before all the files used the same key.
By the way, the program I uploaded can be used to encrypt files too. Yours can too if the user can set the key.

[ProWo]

Did the other files require something other than 0x3B?

Yes, any file has it individual key, so g.e. the two little files above 0x54 and 0x2B.

[Quint]

Maybe the keys are stored in MSSQL-Server.

[ProWo]

Maybe the keys are stored in MSSQL-Server.

The keys do not need to be stored anywhere.
As these are mp4 videos, the respective key is always the first hex byte.

[jagabo]

Did the other files require something other than 0x3B?

Yes, any file has it individual key, so g.e. the two little files above 0x54 and 0x2B.

Thanks. I'll modify my program to default to using the first byte of the file, or a user supplied value. I'm away from home now so it may be a few days.

[Quint]

Maybe the keys are stored in MSSQL-Server.

The keys do not need to be stored anywhere.
As these are mp4 videos, the respective key is always the first hex byte.

Got it now. mp4 has always zero there, so you can calculate. I did not read everything above. Nice.

[jagabo]

Here's an update of my earlier program that gets the key from the first byte of the encrypted file:

/************************************************************************/
//
//	"Decrypt" a file by XORing each byte with 0x3B.
//
//	usage: Decrypt EncryptedInput.mp4 DecryptedOutput.mp4
//
/************************************************************************/


#include <sys\types.h>
#include <sys\stat.h>
#include <io.h>
#include <stdlib.h>
#include <stdio.h>
#include <fcntl.h>
#include <string.h>

#define BUFSIZE (1024*1024)

unsigned char inbuf[BUFSIZE];

/************************************************************************/

int main(int argc, char **argv)
{
	int infd, outfd;
	int inlen;
	unsigned char key;

	infd = _open(argv[1], _O_RDONLY | _O_BINARY);	// open the input file
	if (infd < 0)
	{
		fprintf(stderr, "Error opening input file (%s)!\n", argv[1]);
		exit(1);
	}
	_lseek(infd, 0, SEEK_SET);

	outfd = _open(argv[2], _O_CREAT | _O_WRONLY | _O_BINARY | _O_TRUNC, _S_IREAD | _S_IWRITE);	// create the output file
	if (outfd == -1)
	{
		fprintf(stderr, "Error opening output file (%s)!\n", argv[2]);
		_close(infd);
		return(1);
	}

	int first_time = 1;	// first time through the loop get the key from the first byte of the file

	while(1)
	{
		inlen = _read(infd, inbuf, sizeof(inbuf));	// read in an encrypted block
		if (inlen <= 0)
			break;

		if (first_time)	// first time through the loop, get the key from the first byte of the block
		{
			key = inbuf[0];
			first_time = 0;
			printf("Decryping \"%s\" to \"%s\" using key 0x%02X\r\n", argv[1], argv[2], key);
		}

		for (int i=0; i<inlen; i++)
		{
			inbuf[i] = inbuf[i] ^ key; // decrypt each byte of the block
		}
		
		_write(outfd, inbuf, inlen);	// write out the decrypted block
	}

	_close(infd);
	_close(outfd);
	exit(0);
}

/************************************************************************/

[bladerelic]

holy cow! sorry for the delay in my reply. i've been busy working. i will try out the posted script later today to see how it works with these files. thank you everyone for your time and efforts

[jagabo]

Attached is a Windows 64 bit CLI build of the source in post #26.

[bladerelic]

Attached is a Windows 64 bit CLI build of the source in post #26.

thank you. check your pm whenever you can

[ahmed00007]

can you find a way to decrypt this file please