I became curious about how Trend Micro communicated with its servers so I gleaned some of the unique and standard HTTP headers that were being sent back and forth using Fiddler2. I created a winsock program in C++ that sends the following:
GET /T/128/y2k-L48MLwdH0BuLxZvYxGjK5An-UV6lY772ppsBGZ3ojsPfa37NjMDonK98FPZesq5hXXOsV082oIdmeTaWURWiB4qqibZGVy8ZzCKKDLpZ9ekYPU7X4UgyBnKWFENX HTTP/1.1 Host: titanium80-en.url.trendmicro.com User-Agent: TMUFE Accept: / X-TM-UF-INFO: 76/Uj3tcG7ArMH0ktdN_RiX6fLyEhB2sQWJhjJRJufMEMElv7j6EizpjjDSQd_cUW5fMormb8Q8FN4= Connection: Keep-Alive
Obviously I don't know what those encrypted values are because I only copied and pasted them from Fiddler to see what the server would reply with which was an encrypted string like so:
XnbdFqiy5YGldi-HnN5y7pH0kZ03J_UsH-bZ5JUi0aNEj-aa1P8cQlU9I2b77Jf-Rgd1fepEqlTp H_LlvWDqe0YjWKvw01M1zkXx_iAbFIm9Ld_QcUTw9cQsNIok7-cOK8wKVyDR63SVwBjebXthWKh0kBW3 wWn3Y0D7UoGDYSeSJfLoqSroByZligLXqEZ5
I need to know where in the program, once I've decompiled it using something like Cheat Engine and have the hexadecimal, I can find the encryption or encoding being used and or a key.
UPDATE: After using an encoding detector and suggestions from different people I tried decoding it as base64 but I keep getting symbols and gibberish as follows:
//GÐÅØÄ. Any knowledge on this would be greatly appreciated. :)