I'm able to see the packets before they're encrypted by setting a breakpoint before the encryption subroutine. My problem is that this subroutine is really complicated and goes really deep. Which steps should I follow in order to obtain this encryption function? Or rather to be able to decrypt this packet protocol?
-
Have you used signsrch to check if your program has some standard encryption algorithms linked in?– Guntram BlohmSep 8, 2015 at 21:56
-
Now i did. Here's the result: i.imgur.com/GGjXa7Z.png– AcarXSep 9, 2015 at 5:52
-
This is a good start - there are several encryption algorithms in your binary (AES (Rijndael), Windows Crypt, Blowfish, ...). Set hardware breakpoints on those data tables, and step over the encryption function. Or, check where these tables are used, and set normal breakpoints on the code that uses them. Or, look at the source code of open-source implementations of these, and compare the source with your subroutine.– Guntram BlohmSep 9, 2015 at 6:04
-
I'm afraid i cannot find the address(003758f8 for ex.) for these tables in IDA.– AcarXSep 9, 2015 at 6:45
-
This is because these are file offsets, and IDA label names are made from memory locations. But IDA shows the memory location and the file offset next to each other at the bottom of the IDA View (disassembly resp. graphical view), this should help you find them.– Guntram BlohmSep 9, 2015 at 6:57
|
Show 3 more comments