-1

I am trying to reverse engineer a packet protocol and I was abled to find a subroutine which is likely to be an encryption function. I do not know much about cryptography but it looked like a CBC encryption. Here's the pseudocode I got from IDA: http://pastebin.com/UGYpbthr and here is a part from the original subroutine: http://i.imgur.com/N4jOzlG.png also here's a part from where the subroutine is called: http://i.imgur.com/nBJoROc.png . Is it possible to translate this pseudocode to C code without further reverse engineering ? If so how should I do it ?

  • 3
    For me, your function has remarkable simiarity with blowfish_enc from tls.mbed.org/blowfish-source-code, with the loop in that source unrolled by the compiler. W.S. is right in that the function doesn't access global variables; however, the three parameters (typed int by IDA) are in fact pointers, if you check their usage, so you need the data fields they point to anyway. – Guntram Blohm Sep 18 '15 at 12:45
  • Thanks, as you said blowfish_enc is really similar to my function. Is it possible that it is actually the same function ? – AcarX Sep 18 '15 at 13:03
  • 2
    It looks at least similar. If i were you, i'd run the original program until your function, note the data, step over the function, note the data again, then plug that into the blowfish source and check if it does the same stuff. You'll have to call mbedtls_blowfish_setkey first, and i'd guess might find this function in your original code as well if you look for it. – Guntram Blohm Sep 18 '15 at 13:13
2

This specific pseudocode is actually regular C code because it doesn't access global variables and stack. You'll probably need to add some typedefs for basic types. Please note that this code should be compiled as 32 bit code (or any other where sizeof int is equal to sizeof of pointer for your specific system) to avoid problems with pointer sizes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.