The way obok works is that it tries to decrypt the encrypted files with a couple of different symmetric encryption keys. There's no way to check if a key worked beyond peeking into the decrypted contents and looking for things like Unicode BOMs, XML fragments, or JFIF headers.
It got changed over time to test different things, and perhaps it now finds false positives.
https://github.com/noDRM/DeDRM_tools...k/obok.py#L589