title: How can I defeat RC4-like obfuscation?
body: <p>I am trying to read data files generated by a program originally written in Visual Basic 6 (and later rewritten in Java) so I can process them using my own tools.</p>
  
  <p>The program in question is public domain software created by the U.S. Government; there is no license agreement that prohibits this. I cannot mention the program's name or link to its web site because the programmer probably would change the obfuscation in next year's version, and I would have to repeat my reverse engineering effort.</p>
  
  <p>The underlying data file format is text based, and the obfuscation is some kind of stream cipher with a hardcoded key. I can XOR data files together to get some of the data out (filling one of the string fields with a repeating ASCII character), but I would like to avoid embedding the entire keystream within my program.</p>
  
  <p>Searching through the .exe file reveals a call to a subroutine named RC4ini and a string that I believe is the key (it does not appear anywhere in the user interface). I found what could be the source code to this encryption library on <a href="http://web.archive.org/web/20100605102558/http://www.planet-source-code.com/vb/scripts/ShowCode.asp?txtCodeId=1736&amp;lngWId=1" rel="nofollow">Planet Source Code</a>, made the correct changes to a working implementation of RC4 (in JavaScript, as that is the programming language I mostly work in), and tried using it.</p>
  
  <p>I attempted to search for the encrypted data at every offset in the file, but I did not succeed in decryption. Why this is happening?</p>