-3

I want to locate AES code portion in binary after reverse engineering. I have tried to locate manually and using plugin findcrypt2 but I was not successful. Kindly show me a direction so that I can work on this topic.

I am using Windows 10 operating system. The application I am reversing is AESCrypt and 7-zip. The Tool I am using for disassembly is IDA pro and also used findcrypt2 plugin but it did not work well. I have looked for the S-box and used the plugin to detect that specific area but I have no clue where to look

Any help would be highly appreciated.

2
  • 1
    That's a bit of a broad question. I suggest you mention (either by tag or in the body) the architecture ("CPU") as well as the environment ("OS") and what exactly you have been trying. – 0xC0000022L May 14 '18 at 8:31
  • Sir I am using Windows 10 operating system. The application I am reversing is AESCrypt and 7-zip. The Tool I am using for disassembly is IDA pro and also used findcrypt2 plugin but it did not work well. I have looked for the S-box and used the plugin to detect that specific area but I have no clue where to look. – Waqas Khattak May 14 '18 at 17:17
5

The best way to locate AES in a binary blob would be to locate first the AES S-box. It is specifically designed for AES and recommended by the NIST, so a standard AES must include it. Moreover, they are quite unique and easily found through a simple pattern recognition. Here is the value of such S-box:

unsigned char s[256] = 
{
  0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B, 0xFE,
  0xD7, 0xAB, 0x76, 0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 0xAD, 0xD4,
  0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0, 0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7,
  0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15, 0x04, 0xC7, 0x23, 0xC3,
  0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75, 0x09,
  0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3,
  0x2F, 0x84, 0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE,
  0x39, 0x4A, 0x4C, 0x58, 0xCF, 0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85,
  0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8, 0x51, 0xA3, 0x40, 0x8F, 0x92,
  0x9D, 0x38, 0xF5, 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2, 0xCD, 0x0C,
  0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19,
  0x73, 0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 0x46, 0xEE, 0xB8, 0x14,
  0xDE, 0x5E, 0x0B, 0xDB, 0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, 0xC2,
  0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79, 0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5,
  0x4E, 0xA9, 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08, 0xBA, 0x78, 0x25,
  0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A,
  0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, 0x61, 0x35, 0x57, 0xB9, 0x86,
  0xC1, 0x1D, 0x9E, 0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, 0x9B, 0x1E,
  0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF, 0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42,
  0x68, 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16
};

Once the S-box is located, try to find every function that look at this memory address and you will locate the AES encryption/decryption algorithm.

4
  • 3
    Why don't you spend some time describing what you already tried first? It will spare our time and you will get more accurate answers. – perror May 13 '18 at 16:19
  • 2
    Go learn assembly... there is no other way if you want to reverse a binary program. – perror May 13 '18 at 18:32
  • 1
    Of course there's a myriad of ways to camouflage the S-Box and only reveal it at runtime. – 0xC0000022L May 14 '18 at 17:50
  • Sir thank you for your guideline. I want to say I have successfully identified the S-Box and that was in 7z.dll file not in exe. Now I want to know what should I do to see what key length is used and which type of encryption is used like CBC/ECB etc – Waqas Khattak May 17 '18 at 17:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.