I'm able to see the packets before they're encrypted by setting a breakpoint before the encryption subroutine. My problem is that this subroutine is really complicated and goes really deep. Which steps should I follow in order to obtain this encryption function? Or rather to be able to decrypt this packet protocol?

  • Have you used signsrch to check if your program has some standard encryption algorithms linked in? Sep 8, 2015 at 21:56
  • Now i did. Here's the result: i.imgur.com/GGjXa7Z.png
    – AcarX
    Sep 9, 2015 at 5:52
  • This is a good start - there are several encryption algorithms in your binary (AES (Rijndael), Windows Crypt, Blowfish, ...). Set hardware breakpoints on those data tables, and step over the encryption function. Or, check where these tables are used, and set normal breakpoints on the code that uses them. Or, look at the source code of open-source implementations of these, and compare the source with your subroutine. Sep 9, 2015 at 6:04
  • I'm afraid i cannot find the address(003758f8 for ex.) for these tables in IDA.
    – AcarX
    Sep 9, 2015 at 6:45
  • This is because these are file offsets, and IDA label names are made from memory locations. But IDA shows the memory location and the file offset next to each other at the bottom of the IDA View (disassembly resp. graphical view), this should help you find them. Sep 9, 2015 at 6:57


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.