I'm able to see the packets before they're encrypted by setting a breakpoint before the encryption subroutine. My problem is that this subroutine is really complicated and goes really deep. Which steps should I follow in order to obtain this encryption function? Or rather to be able to decrypt this packet protocol?

  • Have you used signsrch to check if your program has some standard encryption algorithms linked in? – Guntram Blohm Sep 8 '15 at 21:56
  • Now i did. Here's the result: i.imgur.com/GGjXa7Z.png – AcarX Sep 9 '15 at 5:52
  • This is a good start - there are several encryption algorithms in your binary (AES (Rijndael), Windows Crypt, Blowfish, ...). Set hardware breakpoints on those data tables, and step over the encryption function. Or, check where these tables are used, and set normal breakpoints on the code that uses them. Or, look at the source code of open-source implementations of these, and compare the source with your subroutine. – Guntram Blohm Sep 9 '15 at 6:04
  • I'm afraid i cannot find the address(003758f8 for ex.) for these tables in IDA. – AcarX Sep 9 '15 at 6:45
  • This is because these are file offsets, and IDA label names are made from memory locations. But IDA shows the memory location and the file offset next to each other at the bottom of the IDA View (disassembly resp. graphical view), this should help you find them. – Guntram Blohm Sep 9 '15 at 6:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.