0

Here is the file that I am trying to findout a way to decrypt.
settings.ini
This file is from the settings of the MetaTrader 5. The same is the name of the application.
Kindly suggest a better way so that I could read what is there in the encrypted settings file.

  • 1
    Add more context such as where's this file from? Which application parses this file? – sudhackar Nov 1 at 12:14
  • @sudhackar Look I have updated the question. please let me know now what I can do. – Jaffer Wilson Nov 1 at 12:56
  • RE the binary to investigate how the binary decrypts/reads that file. – Michael Pittino Nov 1 at 18:51
  • @MichaelPittino How I can do that? I am clueless. Hence I am here. May be I will get some clue. Can anyone suggest a methodology for that? – Jaffer Wilson Nov 4 at 6:50
  • @MichaelPittino Cn you help me with that? Please let me know. – Jaffer Wilson Nov 5 at 7:11
2

There’s very little chance of success if both encryption algorithm and the key is unknown (besides trivial cases like single byte XOR) so you need to work on discovering those things. Since you have the program which can read the file, the information must be inside it. You can try to find the decryption function by static analysis (disassembly/decompilation) or dynamic (debugging). Once you found it, you can either try to determine the algorithm (e.g. from the magic constants used by the code) or treat it as a black box and reproduce the algorithm in your own implementation. One more approach is to use the code as is and either call it with your own data or run the program normally and capture the data in memory one it’s been decrypted.

In summary, there is no magic one click solution but as long as you have something which can decrypt the file and can inspect/observe it, the task is solvable.

  • Thank you very much for your insightful reply. But I have tried debugging the program which decrypt these file do not let me debug it. I have tried install Scylla Hide plugin which avoid the detect of the debugger, still not working. – Jaffer Wilson Nov 7 at 9:04
  • Is there anything else you could help me with. I will certainly accept the answer if you can help me decrypt this file. if you need I can share the program that will decrypt this file. If you can help me let me know. – Jaffer Wilson Nov 7 at 9:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.