1

I'm reversing a C++ program using IDA PRO to examine how the some data is stored, encrypted and decrypted.

I've managed to identify the data is encrypted with AES CBC 16 block and 256 bit key. I have tested this as I have found the generated key in the program and managed to decrypt the data using online tools.

The problem I have is working out how the AES 256 bit key is generated. I have identified the code but is several hundered lines long. I "think" its a cut n copy of one of the hash functions from OpenSSL as I see references to that in other areas of the code but I cant be 100% sure.

There isn't much to go on in the code except a few magic numbers like 0x2AAAAAAB and that 3 DWORDS are pushed to the stack before the sub is called.

I've downloaded the OpenSSL code but cant find anything yet. I've also used tools like Detect it Easy and a Plugin for IDA, which finds some crypto signatures which I BP, but they are never hit when stepping over the keygen function.

Can anyone recommend anything what can help which this ? My ASM skills are no where near good enough to Single Step several hundreds of instructions.

EDIT: I used the Hex Rays decomplier for the specific func and it churned out only a few lines of code !?!

I've put it on paste bin at:

https://pastebin.com/y6Zu42Ux

Can anyone explain what it does ? However I'm not even sure this is the correct code as no matter where I press F5 to generate the Pseudo Code, it gives me the same output.

EDIT: here is the paste of the full code

https://pastebin.com/x0pjyuZD

  • Please also make the disassembly listing available for this function. – fpmurphy Aug 12 '18 at 3:27
  • googling the constants 0xc48, 0x848 and 0x448 is a good idea. rohitab.com/discuss/topic/36066-blowfish relates this to blowfish somehow – sudhackar Aug 12 '18 at 7:36
  • added a pastebin link to the full code – henda79 Aug 12 '18 at 10:43
  • @sudhackar There are references to blowfish in the code but I'm not sure this routine is part of it. I've posted the full code of that routine and a few small subs it uses – henda79 Aug 12 '18 at 10:47
  • Yes, I found the decrypt routine as I can see the cleartext at the end and I can see the key used to decrypt, but I cant work out how it generates the key as the routine is so long. – henda79 Aug 12 '18 at 14:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.