oh wow.
so this DOS game (name hidden for Reasons) uses encryption, probably for anti-piracy reasons, right?
But here's the thing: the encryption is the kind where applying it to an encrypted file decrypts it, and applying it to a decrypted file encrypts it

so how do they use this? so there's a .BAT file called "run.bat' that comes with it, which does the following:

ENCRYPT game.exe KEYHERE
game.exe
ENCRYPT game.exe KEYHERE

so when you try to load the game, it decrypts it, plays it, then when you exit, it decrypts it.

ok, so... wow. so many problems here

the first one is that THE KEY IS IN THE BATCH FILE.
WHO IS THIS STOPPING? THE WORLD'S LAZIEST PIRATE?

secondly, what if the game doesn't exit properly? what if the computer is just turned off, rebooted, or the game just crashes?

well, when the game tries to decode itself before playing, it'll actually... encrypt itself.
and then try to run an encrypted file, which'll fail badly.

although amusingly this is self-fixing:
once you try to run the encrypted file and fail, your computer will crash and you'll have to reboot.
but now the file is encrypted again, like it's supposed to be, so when you load it again, it'll decrypt itself and then run

so, let's hack the encryption. why? no reason. we can avoid it just by running it once and then removing the encryption calls from the batch file, but I'm feeling up to it.

We could reverse engineer the encrypt binary, but that sounds hard (it's almost a thousand bytes of 16bit x86 code!)

so let's crack the encryption without even looking at a single byte of encrypt .com

STEP ONE:
open hex editor, make a file that's 256 bytes of 00.

step 2: run encrypt on it with a key of our choosing.
let's try "foobar".

now we open up our 256 bytes of 00 file and oh look
it's now become "foobar" repeated over and over.
why is that?

The answer is it's the laziest kind of encryption with a key:
it's XOR.
So XOR is an operation where the output is 1 if one of the inputs is 1, and 0 otherwise.

the fun thing about xor is that you can apply it to a sourcetext and a key, and you generate some scrambled output, but if you apply the key again, it reverts back to the original value. So you don't need separate "encryption" and "decryption" code, you just apply XOR every time

the simple way to think about how XOR encryption works is that it basically toggles bits, but only sometimes.
if the bit in the key is 0, the corresponding bit in the source is not flipped (0 stays 0, 1 stays 1)

and if the bit in the key is 1, you do flip the bit.
a 0 becomes a 1, and a 1 becomes a 0.
You just need to do this for every bit in the source, repeating the key as many times as needed.

In theory XOR would be perfectly secure if your key was the same length as your sourcetext... but it's usually not. usually it's like kilobytes or megabytes of source and a key like "foobar"

and here's the big problem with short keys and applying xor on executable files: THEY TEND TO HAVE LOTS OF ZEROS IN THEM.
And remember how I said XOR doesn't flip the bit if the key is 0?
well, it's symmetric. if the source is 0, it doesn't flip the key...

meaning that any parts of your input file that are zeros just turn into your key in the output.
that's why our dummy file turned into foobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobar

so yeah, right now the batch file pointlessly leaks the key to us, but imagine it didn't? maybe it instead queries the key from a dongle or a server or god knows what.
would that be secure, assuming it's still short? NOPE!

Here's the header of our EXE, unencrypted.
Now the magic encryption process is going to run on it, and turn it into unbreakable code, and we'll never guess the key...

and now, it's encrypted! no one will ever figure out our highly secure password... what? how did you figure out it's "easy2guess"?

I think the designers of this game maybe heard about encryption but didn't really understand how it worked or how to apply it

BTW, I slightly lied about how the batch file worked.
there's actually TWO exe files that get encrypted and decrypted.
So you can actually manage to glitch your way into a situation where one is encrypted and the other isn't.

which means every time you run the batch script it'll encrypt one and decrypt the other.

I suspect they got Encrypt from somewhere else, and also it turns out that like half of it is just help text.

BTW I was wondering if there was some kind of secondary checking which'd mean that running the game without the whole decrypt/encrypt steps wouldn't work, but... nope!
you can just delete the encryption out of the batch file, manually decrypt them once, and it's fine