Making sense of an encoded JSON string

Question

I extracted a game file, which is in JSON format, it's a bit too long, so I'll omit parts of it:

{name: "\xEE\xB5k~u\u03D7\x80\xF8\xE0\xE2\xC5\xCA\xEE\u04CF\x90\xBE\xD8Cs\xFE\xA5Ec\u007F\u0006\x85\xA2\xB2\xD87",
      f03: 2,
      f04: 300,
      f05: "\xE5\u007Fe\u0001\xF7\xFCC\x87\xF0xK\xF7",
      desc: "l8\x88\xF6\xCE\u0012\xC8-8g>{\xE6&\xAB\u03E4f\x8C\u0012\xDD/\x81\x91\xF7\u007F\xD2\u0019\u000E\x87\xF7\xF07Ek\xFC\xCEtU\u0002\x9F@eJ\xB0\xFA\x93\xA8>5\x9BK\xAF\xE0\u001D\xA1\u0006\xE8\u001D.r\xF5\u041F\u05CB1\xF5J\u000F\"\xC6\u001B4\xB7\u0000\x97o\xA4>\u00158q\xE4\x9B\xE2z51N\fe{\xECV\u0011\xAE']|#X'\b\xCE\u0005\xEEg\xC3\uFE9Be\u0018\xC0\xDE\u0006>;\u0002\xFB\u0002;j\xC4{\xE9\u0013P\xE8a\xC9C\x8B\xE65\x87\u063Ac(o\xB1\xD9\xF4\xAF\xC0_D\u001B\xE7\u0013n\u0306\x81\xD9W\xA8\xC9:\x96\x93\xC7\u0006\u0014\xA8\x8E\xC0\x96*q\u000E<\xC1\xA1\u0005\xC6\xD9\xE5\u0007(t;\x92\x8B^\x91c\xFB=l"}

I'm having trouble how to make sense of name, f05 and desc fields, no idea how to decode them. It seems like a mix of hex and Unicode.

The game is able to convert them into readable format, so there must be some way to decode them.

For reference, the name string translates to '[A Duty to Honor]' Kirito, and f05 is for serif.

If anyone can tell me on how to decode this, it'll be appreciated.

Answer 1

They are encoded character strings in the form of byte streams.

But before encoded, they are highly likely somehow obfuscated or encrypted – and this is the main problem.

The decoding itself is not a such problem – you need to know how they are encoded, or try different encoders one after other (in spite there are many tens of them as big5, cp273, iso-8859-5, gb18030-2000 – but some of them are only for specific natural language / languages).

If you know the encoder (or at least the natural language of your game to limit the set of possible encoders), you may decode it, e.g. in Python, as I will show you:

Preparation:
I will encode a string (in Python) to receive a byte stream similar to yours:

>>> "Ľαaβ4γ•a∞".encode("utf-8")
b'\xc4\xbd\xce\xb1a\xce\xb24\xce\xb3\xe2\x80\xa2a\xe2\x88\x9e'

Note the notation - the letter b (for byte sequence) immediately followed by the encoded string in apostrophes (quotes are good, too).

Proper decoding:

>>> b'\xc4\xbd\xce\xb1a\xce\xb24\xce\xb3\xe2\x80\xa2a\xe2\x88\x9e'.decode("utf-8")
'Ľαaβ4γ•a∞'

Particularly, for the value "\xE5\u007Fe\u0001\xF7\xFCC\x87\xF0xK\xF7" of your key f05 (don't forget to put b at the beginning):

>>> b"\xE5\u007Fe\u0001\xF7\xFCC\x87\xF0xK\xF7".decode ("utf-8")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
UnicodeDecodeError: 'utf-8' codec can't decode byte 0xe5 in position 0: invalid continuation byte

So it is definitely NOT encoded as utf-8.

You may try other decoders from this table, e.g. unicode_escape:

>>> b"\xE5\u007Fe\u0001\xF7\xFCC\x87\xF0xK\xF7".decode ("unicode_escape")
'å\x7fe\x01÷üC\x87ðxK÷'

It is better, but – as I already wrote – you will never obtain directly the string "serif", because it is in the encrypted form. You have in addition to decrypt the result of decoding, but it is impossible without knowledge of the encryption schema and a decryption key.