I am reversing Cryptex.exe 1.0 from Eldad.

enter image description here

There is unknown-data buffer address stored in edx which gets used as parameter for CryptHashData, which will hash 20 Bytes from there. Now I want to find which function actually writes this buffer (edx stores 0019F578 at this point of debugging) I don't get smart with [esp+C], because esp should be the last push exc, and counting from there it should be push 0?

What I want to try is setting a breakpoint on .data 0019F578 without break (since it gets used alot by the program in general) and tracing all functions called till the breakpoint ds:CryptHashData. But that doesn't work in IDA. IDA will not recognize other breakpoints with break after I set up this. I'm glad to learn new methods about tracing, since it's very important to know. enter image description here


Firstly, let's understand what goes into edx. edx contains the first argument passed to this function which is a pointer the data that we want to compute its MD5 hash. Looking at images, stack frame of the current function is like:

esp + 0x0 --> | local_var_8 |
esp + 0x4 --> | local_var_4 |
esp + 0x8 --> | return_addr |
esp + 0xC --> |    arg_0    |

At the beginning of the function, sub esp, 8 reserves 8 bytes on the stack for two local variables. Then you have the return address and arguments coming afterward. All those pushes that are used to pass arguments to CryptCreateHash will be poped back by that function before it returns to the current function, so the previous position of the stack will be preserved.

I believe true reverse engineering consists of understanding the code, not blind trace. Instead of tracing a value on the stack, it is better to look for the caller of this function, understand who has called this function and wherein the code is this function called, and then what is the parameter sent to this function.

Answering the second part of your question, you can customize breakpoints in IDA using some Python skills. You can create a conditional breakpoint for example and disable the break action as you have done. Whenever you hit this breakpoint, you can log the content of eip to find which instruction or wherein the code is this data accessed. If it is before this function, just log the data in, if it is after, you can enable break action again.

For that you need to consider some matters:

  1. You have to practice IDA python APIs. e.g. for getting a register content you have to call GetRegValue. This will help you to begin. Here also you can find the list of all IDA python APIs.
  2. If you set a breakpoint on a data that is passed to a lot of windows APIs such as crypt APIs, you will hit this breakpoint within a lot of library codes. Always look at the address space and if you are not inside your main program, skip them to avoid reversing library functions that are irrelevant to your main program.
| improve this answer | |
  • I was not familiar without the ebp variant. And regarding to you its the calling convention right? That would make sense, and I could also find this in the caller function anyways. If I want to find caller I only see cryptex.exe(current function), kernel32.dll ntdll.dll ntdll.dll in the Call Stack. I thought I would see another crypex.exe to see the caller but don't. Thank you for your help! – killertoge Apr 14 at 15:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.