1

Hello!

I'm working on reversing one library (shared object) written for ARM architecture. It's obfuscated or packed with something pretty strong what makes debugging much harder and almost impossible on "long distance".

There is function which provides encryption with some strange algorithm (at least for me).

What I've researched for now:

  • Size of input and output is same;
  • Algorithm works with 4 memory regions, which affects on result (tested):
    1. Size - 256 bytes. This is SBOX, but with custom values (values are different from AES SBox);
    2. Size - 256 bytes. This is inverted SBOX;
    3. Size - 16 bytes. Probably, initialization vector, but I'm not sure;
    4. Size - 128 bytes. Unknown region.
  • Decryption function also works with same memory regions.

For now I know only first operations in data in algorithm:

  1. Reverse bits in each byte (0x30 (00110000b) => 0xC (00001100b));
  2. Reverse bytes (01 02 03 04 05 06 07 08 => 08 07 06 05 04 03 02 01)

Some additional information:

  • If input length < 15 it's just reverse bits and bytes.

    Example (bytes in hex):

    01 01 01 01 01 01 01 01 => 80 80 80 80 80 80 80 80 80

  • If input length is 15 it reverse bits in all bytes except 4th. Then reverse bytes.

    Example (bytes in hex):

    01 01 01 02 01 01 01 01 01 01 01 01 01 01 01 =>

    80 80 80 80 80 80 80 80 80 80 80 80 02 80 80 80

  • If input length is 16 it reverse bits and bytes, encrypts data with this "unknown" algorithm;

  • If input length is 17-32 it'll reverse bits and bytes in first 16 bytes, encrypts first 16 bytes with this algorithm and just reverse bits and bytes in rest data.

    Example: (bytes in hex, bold bytes contains result of encryption):

    01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 02 03 04 05 =>

    50 D4 51 BD 59 42 30 A1 B3 5F 77 BD B3 BF A1 9A A0 20 C0 40

I have opportunity to launch encryption on any data and change all variables. Also I have opportunity to launch built-in decrypt function.

Maybe someone know what it can be or can recommend me some additional steps to clarify name of this algorithm.

P.S. Sorry for my bad English, hope I've described everything clear.

  • 3
    I could not really understand the following sentence (and examples didn't help either): "For now I know only first operations in data in algorithm". Moverover, have you considered actually reverse engineering the algorithm? Creating code or pseudo code for the algorithm, etc. Additionally, have you tried collecting magic values from the library and seaching for them online? – NirIzr Nov 22 '18 at 3:49
  • Hello, @NirIzr . As I've mentioned, code is obfuscated by smth, and it's really hard to debug it. In sentence "For now I know only first operations in data in algorithm" I've meant that I've started "tracing" through code and for now I found next data transformations. I need to implement this algorithm (write external code which will do same encryption). About "googling" constants - it's the first what I've done (no results). – Olvin Roght Nov 22 '18 at 8:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.