Zynga base64 data column, what is it?
by datahub - September 13, 2021 at 09:33 AM
#1
Hi,

Has anyone processed Zynga dump and figured out what the base64ed "data" column does?
There's two popular formats, one starts with BAh and other starts with 8QA. After decoding there are some readable stuff in plaintext such as

00000000  04 08 7b 08 3a 12 61 63 63 65 70 74 65 64 5f 65  |..{.:.accepted_e|
00000010  75 6c 61 7b 06 6c 2b 07 7e c5 c6 53 6c 2b 07 1d  |ula{.l+.~ÅÆSl+..|
00000020  05 e0 53 3a 0c 74 77 69 74 74 65 72 30 49 22 10  |.àS:.twitter0I".|
00000030  64 65 6c 65 74 65 64 5f 66 6f 72 06 3a 06 45 54  |deleted_for.:.ET|
00000040  49 22 32 44 65 6c 65 74 65 64 20 64 75 65 20 74  |I"2Deleted due t|
00000050  6f 20 69 6e 61 63 74 69 76 69 74 79 20 28 6c 65  |o inactivity (le|
00000060  67 61 6c 20 72 65 71 75 69 72 65 6d 65 6e 74 29  |gal requirement)|
00000070  06 3b 07 54                                      |.;.T|


Or

00000000  f1 00 00 00 dd 2d 04 08 7b 0a 3a 12 61 63 63 65  |ñ...Ý-..{.:.acce|
00000010  70 74 65 64 5f 65 75 6c 61 7b 07 6c 2b 07 7e c5  |pted_eula{.l+.~Å|
00000020  c6 53 5b 00 1d 05 e0 7b 00 80 5d fb 78 00 0c ad  |ÆS[...à{..]ûx...|
00000030  52 0f 54 3a 19 66 61 63 65 62 6f 6f 6b 5f 54 06  |R.T:.facebook_T.|
00000040  00 0f 6f 75 6e 74 5f 69 64 73 7b 06 6c 2b 08 a9  |..ount_ids{.l+.©|
00000050  e5 01 9a a0 a0 69 04 99 2d ea 04 49 22 15 62 6c  |å..  i..-ê.I".bl|
00000060  6f 63 6b 4c 0a 00 08 62 79 5f 75 73 65 72 73 06  |ockL...by_users.|
00000070  3a 06 45 54 5b 09 69 04 ed 83 27 0a 69 04 e5 02  |:.ET[.i.í.'.i.å.|
00000080  42 57 00 ea b1 57 54 00 0a 72 25 71 0a 49 22 1a  |BW.ê±WT..r%q.I".|
00000090  72 65 63 65 69 76 4b 06 6c 61 70 44 06 00 05 5f  |receivK.lapD..._|
000000a0  67 72 61 6e 74 06 3b 07 54 7b 06 49 22 0d 57 6f  |grant.;.T{.I".Wo|
000000b0  72 64 47 61 6d 65 61 02 54 0c 03 02 21 61 72 63  |rdGamea.T...!arc|
000000c0  68 96 05 74 69 5d 0c 74 08 01 55 05 73 0f 24 74  |h..ti].t..U.s.$t|
000000d0  69 6f 08 01 6e 04 69 06 11 00 00                |io..n.i....|



I've tried almost all file format identification tools or signature detection tools but none of them successfully identified the format. They seem to contain some kind of object structure in highly abstracted form.
If anyone has successfully decoded them please help me!
Reply
#2
It's a PHP serialized object.
Reply
#3
(September 13, 2021 at 08:17 PM)Shackler Wrote: It's a PHP serialized object.

Doesn't seem like it. Have you successfully de-serialized them?
Reply
#4
Sorry I was wrong, didn't look that closely last time I was looking but I went and tested. It's a Ruby serialized (marshal) object.


require 'base64'
a = Marshal.load(Base64.decode64("BAh7CDoSYWNjZXB0ZWRfZXVsYXsGbCsHfsXGU2wrB/4G4FM6DHR3aXR0ZXIwSSIQZGVsZXRlZF9mb3IGOgZFVEkiMkRlbGV0ZWQgZHVlIHRvIGluYWN0aXZpdHkgKGxlZ2FsIHJlcXVpcmVtZW50KQY7B1Q="))

puts a

{:accepted_eula=>{1405535614=>1407190782}, :twitter=>nil, "deleted_for"=>"Deleted due to inactivity (legal requirement)"}
Reply
#5
(September 14, 2021 at 11:54 PM)Shackler Wrote: Sorry I was wrong, didn't look that closely last time I was looking but I went and tested. It's a Ruby serialized (marshal) object.


require 'base64'
a = Marshal.load(Base64.decode64("BAh7CDoSYWNjZXB0ZWRfZXVsYXsGbCsHfsXGU2wrB/4G4FM6DHR3aXR0ZXIwSSIQZGVsZXRlZF9mb3IGOgZFVEkiMkRlbGV0ZWQgZHVlIHRvIGluYWN0aXZpdHkgKGxlZ2FsIHJlcXVpcmVtZW50KQY7B1Q="))

puts a

{:accepted_eula=>{1405535614=>1407190782}, :twitter=>nil, "deleted_for"=>"Deleted due to inactivity (legal requirement)"}

Awesome, thank you very much!

(September 14, 2021 at 11:54 PM)Shackler Wrote: Sorry I was wrong, didn't look that closely last time I was looking but I went and tested. It's a Ruby serialized (marshal) object.


require 'base64'
a = Marshal.load(Base64.decode64("BAh7CDoSYWNjZXB0ZWRfZXVsYXsGbCsHfsXGU2wrB/4G4FM6DHR3aXR0ZXIwSSIQZGVsZXRlZF9mb3IGOgZFVEkiMkRlbGV0ZWQgZHVlIHRvIGluYWN0aXZpdHkgKGxlZ2FsIHJlcXVpcmVtZW50KQY7B1Q="))

puts a

{:accepted_eula=>{1405535614=>1407190782}, :twitter=>nil, "deleted_for"=>"Deleted due to inactivity (legal requirement)"}

Still doesn't work for string starts with 8QA... different version?
Reply
#6
I need a database for insurance customers in the US
Reply

Possibly Related Threads…
Thread Author Replies Views Last Post
Zynga (Farmville & Mafia Wars) partial cracked database leaked September 2019 RevenantS 1 1,787 November 19, 2021 at 09:17 AM
Last Post: siba9963258
Zynga dehashed CombatLogs 22 13,161 August 05, 2021 at 05:01 PM
Last Post: kkdj20
SQL DATA SIMPEG.SRAGENKAB.GO.ID LEAKED // AGAMA // DATA CPNS // DATA GAJI // ETC. [VULN] Stars12n 5 3,385 June 26, 2021 at 07:48 PM
Last Post: Gh05t666nero

 Users browsing this thread: 1 Guest(s)