3

I have a packet that I want to analyze which consists 16 bytes. I can produce as much as of these packets needed to analyze.

Even though packet does the same thing on application the data in the packet seems to be changed each time. It works when I record the old packet and use it next time application runs. It also works when first or last 8 bytes are replaced with bytes from previously recorded packets.

My aim is to be able to produce these packets myself. Here's some recorded packets:

0xb1, 0xd0, 0x36, 0xe8, 0x1f, 0xdb, 0xc7, 0x36, 0x66, 0x39, 0x17, 0x15, 0xcc, 0xa1, 0x8a, 0x61
0x17, 0x21, 0x6e, 0x45, 0x0d, 0x3f, 0x08, 0x86, 0xed, 0x55, 0x26, 0x19, 0xf6, 0x15, 0x6b, 0xb1
0x08, 0xb9, 0xd7, 0xe9, 0xa8, 0x80, 0xea, 0x8c, 0x18, 0x5e, 0x92, 0xc5, 0xb7, 0x1a, 0xed, 0xf7
0x2a, 0x12, 0x1c, 0x71, 0x36, 0x00, 0xb3, 0x6f, 0xbb, 0x7b, 0x57, 0x65, 0xe5, 0xa7, 0x45, 0xd4
0x17, 0x21, 0x6e, 0x45, 0x0d, 0x3f, 0x08, 0x86, 0xcf, 0x5a, 0x95, 0xaa, 0x41, 0x88, 0xd3, 0xf1
0xb1, 0xd0, 0x36, 0xe8, 0x1f, 0xdb, 0xc7, 0x36, 0x20, 0x68, 0x45, 0x26, 0x2d, 0xce, 0xc8, 0x32
Improve this question
2
  • 3
    Just to make sure: B1 D0 36 E8 1F DB C7 36 66 39 17 15 CC A1 8A 61 and 17 21 6E 45 0D 3F 08 86 ED 55 26 19 F6 15 6B B1 do the same thing in the application, and B1 D0 36 E8 1F DB C7 36 ED 55 26 19 F6 15 6B B1 does the same as well, but changing one random byte doesn't? Anyway, this sounds like you have to reverse the packet processing function, but if you want to have a (slight!) chance without that, you'd have to provide many more examples.
    – Guntram Blohm
    Sep 16, 2015 at 11:24
  • Exactly as you said. I've tried to reverse the function but i just don't know enough assembly even though i know exactly where the packet is encrypted. I can provide as much examples as needed.
    – AcarX
    Sep 16, 2015 at 11:28

1 Answer 1

Reset to default
3

It may be the case that it's CBC-encrypted data, with the first field being a nonce. Or one of many other possibilities.

Either way, as Guntram said in his comment above, you'd need to reverse engineer the software to determine how this data is parsed.

Improve this answer
1
  • So it's unlikely that i'll get somewhere without reverse engineering the software. Thanks.
    – AcarX
    Sep 16, 2015 at 14:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.