cloudy sky s / Repairtool for ,.mmo,.ndx,.rep,.fic

Yesterday i let my son use my computer.
After half a hour he comes back and tells me his video game is not working anymore.
I noticed all fille extensions had be changed to .ewdf....turned out he got my computer infected with ransomware djvu
all backups where gone (the backup drive was plugged in since it was monthly backup day).

a few years a go i wrote myself a litle prg with windev for self use witch contained a vault function...the prg contained the code(it was string of 350 + characters) aes 128)to unlock the hyperfille.however do to the vault nature the prg wont boot unless it finds its databases.if it dossent it gives a hf error

Needless to say there was crytical data in the vault or the .mmo fille
i have managed to find a backup of the exe fille....sadly it was encrypted 3 years a go i am now running a brute force attack on the 7z fille i expect i should get it open in 1 to 2 weeks.

I expect the .exe fille to not wanne boot complaining its hf are damaged....is there a way i can pass the error hf cant be oppened since not found?

I found a articel online that says that djvu only encrypths the first 150bytes of a fille and adds 333 empty bytes to the fille.Is there crytical information in the first 150 bytes of the .mmo,.ndx,.rep,.fic extensions?
if not is there a tool that can rebuild the fille headers?is there a way i can cut 333 empty bytes out of the filles ? if so how?Or is there any other way i can retrieve the data out of the .mmo fille

Thanks in advance for any help you can offer

There are so many security issues in what you describe that I will not even start...


As for your problem... Ideas

If you have the sources of your vault project, you can easily recompile a new version without any security to read its content...
If not, do you have any old copies of your fic/mmo files?

If yes, use an hex heditor to copy the headers (in your case, the first 150 bytes) then use the hf utilities to try and repair/reindex the files, you may be able to get back most of the content.

as for the 333 added bytes, first figure out where they are (if they were appended or inserted) then you can either use an hex editor and try to remove them manually, or you can write a small windev program to do it