i'm trying to find out the key of a xor encryption but something seems be wrong.
the ecrypted file begins with this hex string: 78DF2B983C9428942894892CD8D6CFF4F8942895289428952894319428949BFD8F0289089D068DC556C458C25D94289428942894289428942894289428942894289428942894289C289428942894289428942894289428942894289428942894289428942894289428942894289428942894289428942894289428942894289428942894289428942894289428942894..
i know this is a zip comressed file. the zip header structure is something like: 504B0304140000000800CC898C459C47ECC9DA8350002DC06400120000003937373048442D56312E30302E352E676E78 (https://users.cs.jmu.edu/buchhofp/forensics/formats/pkzip.html)
the first 4 bytes of a zip header is always the signature: 504B0304, after xor this with the ecrypted hex, i get: 2894289c
but 2894289c seems to be wrong, why? look at the encrypted hex string.. there's lot of '2894' hex values in the content..these must be decrypted '0000', so is '2894' the right key?
now, i xor the encrypted zip header signature with the key '2894' 78DF2B98 xor 28942894 => 504b030c pretty strange, because the last hex value is '0c' but it must be '04'!
what is my fault?
(sorry for my english)