0

This program implements Diffie Hellman key Exchange, a pair of random private keys are generated every time the program runs. How should I go about finding the random number generation subroutine using a disassembler like IDA?

Warning: The program is flagged as malware by Windows Defender.
hxxps://drive.google.com/open?id=1uErzKPIV-HyOBunn0ecF6pehXJ_mDdGR

  • 1
    It's a PyInstaller generated executable. IDA is not quite the right tool here. To answer the question the RNG is randint(2, 198). You can find it after you've extracted the pyc's from the exe. – 0xec Nov 30 at 20:03
  • I extracted pyc files from the exe file, but I am unable to decompile DH file, decompiler says magic number mismatch. How did you decompile DH file? – Deus Ex Dec 1 at 6:08
  • You need to add a 16 byte signature for Python 3.7 at the beginning of the pyc. Without that the decompiler won't recognize it as a pyc file. – 0xec Dec 1 at 20:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.