Timeline for Reverse engineer a checksum algorithm from application
Current License: CC BY-SA 3.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 25, 2016 at 4:20 | comment | added | NirIzr | I feel this is becoming quite a different question and that existing questions might help you here if you search a bit. | |
| Oct 24, 2016 at 23:34 | history | edited | Stefan | CC BY-SA 3.0 |
added 1039 characters in body
|
| Oct 24, 2016 at 0:33 | history | edited | Stefan | CC BY-SA 3.0 |
added 670 characters in body
|
| Oct 22, 2016 at 3:55 | comment | added | Guntram Blohm |
In this kind of scenario, i often use procmon to check what the call stack looks like when the file gets written, which will give me an idea which functions are involved in writing the file, then give those a closer look. More information in my answer to this question. That is about an encrypted xml file, but finding the checksum algorithm would be quite similar.
|
|
| Oct 22, 2016 at 3:01 | answer | added | NirIzr | timeline score: 6 | |
| Oct 21, 2016 at 22:22 | comment | added | mrexodia | You could try something like IDR it helps recognizing Delphi runtime functions. You can then use something like x64dbg, import the MAP and see what's going on dynamically. | |
| Oct 21, 2016 at 22:20 | comment | added | Martin | Open the binary in IDA, xref the file write functions, and you'll find the place where it writes the data. From there, you go back, searching for where is that data created/modified, and you should find the checksum function. | |
| Oct 21, 2016 at 21:07 | review | First posts | |||
| Oct 21, 2016 at 21:08 | |||||
| Oct 21, 2016 at 21:03 | history | asked | Stefan | CC BY-SA 3.0 |