I'm able to see the packets before they're encrypted by setting a breakpoint before the encryption subroutine. My problem is that this subroutine is really complicated and goes really deep. Which steps should I follow in order to obtain this encryption function? Or rather to be able to decrypt this packet protocol?

  • Have you used signsrch to check if your program has some standard encryption algorithms linked in? Sep 8 '15 at 21:56
  • Now i did. Here's the result: i.imgur.com/GGjXa7Z.png
    – AcarX
    Sep 9 '15 at 5:52
  • This is a good start - there are several encryption algorithms in your binary (AES (Rijndael), Windows Crypt, Blowfish, ...). Set hardware breakpoints on those data tables, and step over the encryption function. Or, check where these tables are used, and set normal breakpoints on the code that uses them. Or, look at the source code of open-source implementations of these, and compare the source with your subroutine. Sep 9 '15 at 6:04
  • I'm afraid i cannot find the address(003758f8 for ex.) for these tables in IDA.
    – AcarX
    Sep 9 '15 at 6:45
  • This is because these are file offsets, and IDA label names are made from memory locations. But IDA shows the memory location and the file offset next to each other at the bottom of the IDA View (disassembly resp. graphical view), this should help you find them. Sep 9 '15 at 6:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.