Megumeme501

New Member
Sep 25, 2021
14
4
not yet . but this post might help
He's swapped from using .AOSC to .TD which makes me wonder if this new .TD thing is an actual new file type and not just some kind of unique encrypted thing. Only info on .TD I can find comes back to some Chinese file type called "Thunder"
 

isaussage

Newbie
Aug 28, 2022
56
98
Finally found something.

In librenpython.dll, two export entries that are not present in the old librenpython:

- PyInit_td_loader (Address: 0x00000001806B35F0)
- PyInit_td_script (Address: 0x00000001806CD3B0)

I also Found a class TDArchiveHandler, which speaks for itself
There's some variables i managed to decompile inside of this class:
- aInitLoader = "init loader"
- aTdLoaderPyx = "td/loader.pyx"

Possible decryption key found in variable named "a0x4146682d594a" (that's the name not address)
> 0x4146682d594a35584b612d433256644336427732544e505f3562626d456f773

Also 'TDArchiveHandler' is a custom class made by the devs so there is no way to find info online
 
  • Like
Reactions: devonY7
3.90 star(s) 45 Votes