0

Is there any algorithm that searches through binary file and detects existence of secret S-box built from look-up table (4 bit or 8 bit)? Consider the sbox is unavailable for public

The attached bin data is part of bin file obtained from compiling serpent cipher ( 6 s-boxes) with uint 32 bit array on mac os Mach-o file format. if you split the bin data you will find the values of all 6 s-boxes.

My point is lets consider a bin file you obtained and you do not know any thing about the cipher and location of its info in the bin file. The first thing in your search, you want to look for common things such as S-box or lfsr. I know that there is a plugin in IDA called findcrypt of common ciphers but iam looking for unknown cipher.

0d00 0000 0300 0000 0b00 0000 0000 0000
0a00 0000 0600 0000 0500 0000 0c00 0000
0100 0000 0e00 0000 0400 0000 0700 0000
0f00 0000 0900 0000 0800 0000 0200 0000
0500 0000 0800 0000 0200 0000 0e00 0000
0f00 0000 0600 0000 0c00 0000 0300 0000
0b00 0000 0400 0000 0700 0000 0900 0000
0100 0000 0d00 0000 0a00 0000 0000 0000
0c00 0000 0900 0000 0f00 0000 0400 0000
0b00 0000 0e00 0000 0100 0000 0200 0000
0000 0000 0300 0000 0600 0000 0d00 0000
0500 0000 0800 0000 0a00 0000 0700 0000
0000 0000 0900 0000 0a00 0000 0700 0000
0b00 0000 0e00 0000 0600 0000 0d00 0000
0300 0000 0500 0000 0c00 0000 0200 0000
0400 0000 0800 0000 0f00 0000 0100 0000
0500 0000 0000 0000 0800 0000 0300 0000
0a00 0000 0900 0000 0700 0000 0e00 0000
0200 0000 0c00 0000 0b00 0000 0600 0000
0400 0000 0f00 0000 0d00 0000 0100 0000
0800 0000 0f00 0000 0200 0000 0900 0000
0400 0000 0100 0000 0d00 0000 0e00 0000
0b00 0000 0600 0000 0500 0000 0300 0000
0700 0000 0c00 0000 0a00 0000 0000 0000
0f00 0000 0a00 0000 0100 0000 0d00 0000
0500 0000 0300 0000 0600 0000 0000 0000
0400 0000 0900 0000 0e00 0000 0700 0000
0200 0000 0c00 0000 0800 0000 0b00 0000
0300 0000 0000 0000 0600 0000 0d00 0000
0900 0000 0e00 0000 0f00 0000 0800 0000
0500 0000 0c00 0000 0b00 0000 0700 0000
0a00 0000 0100 0000 0400 0000 0200 0000
0000 0000 0000 0000 0000 0000 0000 0000

closed as too broad by NirIzr, perror, sudhackar, kn0x, peter ferrie Aug 27 '18 at 22:16

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Hi and welcome to RE.SE. Could you provide some more details of, say, the file format you are looking at (e.g. ELF, PE) as well as the target environment in which the binary runs or is this not an executable but rather some kind of text file? As it stands your question is too broad and may get closed. You can always edit your own question and improve it and even if it gets closed you can vote to reopen it and others will have the chance to review your improvements. – 0xC0000022L Aug 25 '18 at 19:55
  • thank you for the response, details are given in the question – hardyrama Aug 26 '18 at 13:29
1

If I'd suspect existence of unknown encryption algorithm in the binary first thing I'd start with would be searching functions which contain too much shift and xor operations relatively to the function size.

From these functions I'd try to find s-boxes if there are any by data X-refs.

  • 1
    So far this is more of a comment than an answer, though. – 0xC0000022L Aug 27 '18 at 11:12

Not the answer you're looking for? Browse other questions tagged or ask your own question.