0

I've used x64dbg to work out decryption in a particular program. I've found where it changes the encrypted material into readable text but can't work out the best way to use this information to convert multiple files.

Is it a standardized encryption method? (eg. blowfish/aes) Assembler

It basically copies the file to memory then cycles through this (and one other cycle above it).

Thanks!

Addit 15/12/2019: OUTER FUNCTION enter image description here

Ouput of signsrch:

  offset   num  description [bits.endian.size]
  --------------------------------------------
  0002b542 2249 TEA1_DS [32.le.4]
  00059090 2065 Haval init [32.le.32&]
  00059090 919  Blowfish bfp table [32.le.72]
  000590b0 1054 Haval hash pass2 [32.le.128&]
  000590e0 921  Blowfish ks0 table [32.le.1024]
  000590e0 2335 Blowfish_s_init [32.le.4096]
  00059138 2067 Haval mc3 [32.le.128]
  00059198 2219 HAVAL2_DS [32.le.32]
  000591b8 2069 Haval mc4 [32.le.128]
  00059218 2217 HAVAL1_DS [32.le.32]
  00059238 2071 Haval mc5 [32.le.128]
  000594e0 923  Blowfish ks1 table [32.le.1024]
  000598e0 925  Blowfish ks2 table [32.le.1024]
  00059ce0 927  Blowfish ks3 table [32.le.1024]
  007b1a86 2545 anti-debug: IsDebuggerPresent [..17]
  007b7e07 1038 padding used in hashing algorithms (0x80 0 ... 0) [..64]

It must be blowfish. Now to find the key!!!

2
  • See if this helps: reverseengineering.stackexchange.com/questions/18673/…
    – Dvd848
    Commented Dec 14, 2019 at 18:29
  • Can you post the cycle above? Also, checking the memory reads at the constants 48 448 848 C48 would be very valuable. Lookup tables usually make spotting the respective crypto algorithm easy. I have a feeling this is AES or AES-related. Commented Dec 15, 2019 at 0:41

1 Answer 1

2

This is probably Blowfish.

Googling the constants "0x448 0xC48 crypto" lead to this post:

Trying to identify block of code which generates 256 bit key

where someone in the comments wrote

googling the constants 0xc48, 0x848 and 0x448 is a good idea.
rohitab.com/discuss/topic/36066-blowfish relates this to blowfish somehow

and that link has code that looks very similar:

http://www.rohitab.com/discuss/topic/36066-blowfish/

(search for C48 there).

The only oddity is that the author of that other post says he is sure it is AES and he said he could decrypt some data using AES. I don't know how to consolidate both ideas, but it's probably either and given the similar disassemblies I'd say Blowfish.

Doesn't look like AES to me either but I had some AES-related crypto before that looked a bit like this - Blowfish is way more convincing.

1
  • That is really helpful!! See above edited post. It must be blowfish. Now I just have to work out where the key and IV is in assembly :-) At least I know what I'm looking for now.
    – Richard S
    Commented Dec 15, 2019 at 1:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.