2

I became curious about how Trend Micro communicated with its servers so I gleaned some of the unique and standard HTTP headers that were being sent back and forth using Fiddler2. I created a winsock program in C++ that sends the following:

    GET /T/128/y2k-L48MLwdH0BuLxZvYxGjK5An-UV6lY772ppsBGZ3ojsPfa37NjMDonK98FPZesq5hXXOsV082oIdmeTaWURWiB4qqibZGVy8ZzCKKDLpZ9ekYPU7X4UgyBnKWFENX HTTP/1.1
    Host: titanium80-en.url.trendmicro.com
    User-Agent: TMUFE
    Accept: /
    X-TM-UF-INFO: 76/Uj3tcG7ArMH0ktdN_RiX6fLyEhB2sQWJhjJRJufMEMElv7j6EizpjjDSQd_cUW5fMormb8Q8FN4=
    Connection: Keep-Alive

Obviously I don't know what those encrypted values are because I only copied and pasted them from Fiddler to see what the server would reply with which was an encrypted string like so:

XnbdFqiy5YGldi-HnN5y7pH0kZ03J_UsH-bZ5JUi0aNEj-aa1P8cQlU9I2b77Jf-Rgd1fepEqlTp
H_LlvWDqe0YjWKvw01M1zkXx_iAbFIm9Ld_QcUTw9cQsNIok7-cOK8wKVyDR63SVwBjebXthWKh0kBW3
wWn3Y0D7UoGDYSeSJfLoqSroByZligLXqEZ5

I need to know where in the program, once I've decompiled it using something like Cheat Engine and have the hexadecimal, I can find the encryption or encoding being used and or a key.

UPDATE: After using an encoding detector and suggestions from different people I tried decoding it as base64 but I keep getting symbols and gibberish as follows: ÖÁ¾ä/Ƽ0and //GÐÅØÄ. Any knowledge on this would be greatly appreciated. :)

Improve this question
1
  • Usually it either means this is Base64 with a custom alphabet, or that the data is effectively binary. As Jason Geffner stated, you'd have to follow the construction of the HTTP request to determine that.
    – user2823000
    Jan 1, 2016 at 10:48

1 Answer 1

Reset to default
2

Using IDA Pro, look for the strings TMUFE and/or X-TM-UF-INFO and find their cross-references. The code that references those strings is part of the code that makes those HTTP requests and handles (decrypts) the server's responses. You can thus analyze that code to determine how your program performs the decryption.

If you'd like further help, you may want to post a link to the target program (assuming it's freeware/shareware/trialware and thus shareable).

Improve this answer
2
  • I wish it was but it's anti-virus software I paid for. Also some people have suggested it's base64 encoded but whenever I decode it I get a bunch of unintelligible symbols and weird characters. I realize this isn't necessarily the place to be asking about encoding but would you happen to know anything about that?
    – Edward Severinsen
    Dec 31, 2015 at 21:49
  • Even if it is a variant of Base64-encoding (for example, replacing + and / with - and _), you'd still need to decode the resulting "Base64"-decoded data (or as you said above, ÖÁ¾ä/Ƽ0 and //GÐÅØÄ). So whether or not the data you're seeing is a variant of Base64-encoding, you'd still need to follow the advice I gave above.
    – Jason Geffner
    Jan 1, 2016 at 23:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.