Timeline for Obfuscated AES decryption assembly
Current License: CC BY-SA 3.0
17 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| S Feb 19, 2016 at 11:30 | history | bounty ended | Joshua | ||
| S Feb 19, 2016 at 11:30 | history | notice removed | Joshua | ||
| Feb 15, 2016 at 12:03 | answer | added | ebux | timeline score: 3 | |
| Feb 15, 2016 at 1:19 | history | edited | Joshua | CC BY-SA 3.0 |
added 88 characters in body
|
| Feb 15, 2016 at 1:18 | comment | added | Joshua | @ebux Been doing more research with this one and could this perhaps be an AES-128 implementation with unrolled rounds? | |
| Feb 13, 2016 at 22:47 | history | edited | Joshua | CC BY-SA 3.0 |
Added full snippets
|
| Feb 13, 2016 at 18:39 | history | tweeted | twitter.com/StackReverseEng/status/698577250573271040 | ||
| S Feb 12, 2016 at 3:12 | history | bounty started | Joshua | ||
| S Feb 12, 2016 at 3:12 | history | notice added | Joshua | Canonical answer required | |
| Feb 11, 2016 at 14:50 | comment | added | Joshua | @ebux Here it is. Thanks for taking a look! | |
| Feb 11, 2016 at 7:01 | comment | added | ebux | The full ASM file would be fine. | |
| Feb 10, 2016 at 18:06 | comment | added | Joshua | @ebux I've updated those snippets with the addresses if it that helps somewhat. Would it be helpful if I uploaded the full ASM file so you can look at what the function looks like towards the end? | |
| Feb 10, 2016 at 8:02 | comment | added | ebux | Although it is hard to follow the code without the addresses, your CBC assumption may be correct. But in the cipher code I can see only that it read out the first byte of the input buffer and fill up a buffer with the modified values of the input byte. It would be interesting also how the output is generated (r3 stores the output pointer) and how the generated buffer is used later on the function. | |
| Feb 9, 2016 at 13:39 | comment | added | Joshua |
@ebux This is the procedure I believe to be using CBC and this is an extended snippet of the block cipher function mentioned in the question (not full as it's a 60MB asm file). The arguments to the calls I believe are as follows sub_44d84(<decryptionFunction=0x1>, <IV>, <bytesToDecrypt>, <decryptedBytes>) and sub_46d554(<bytesToDecrypt>, <output>).
|
|
| Feb 9, 2016 at 12:21 | comment | added | ebux | Based on the above snippets, it does not seems to be AES-128 to me, but could you share a larger snippet or the whole function? | |
| Feb 9, 2016 at 11:54 | review | First posts | |||
| Feb 9, 2016 at 12:08 | |||||
| Feb 9, 2016 at 11:52 | history | asked | Joshua | CC BY-SA 3.0 |