1

I'm trying to extract master key from OpenSSL 1.0.2l (statically linked without debug symbols).

I'm using x64dbg, I was able to locate int SSL_connect(SSL *s) method, so I have a breakpoint there (the breakpoint gets hit). In the result, I have a pointer to SSL parameter that contains SSL_SESSION *session member, in which the master key is located.

The SSL pointer points me the following place in dump: enter image description here

Is there any easy way to find my poiner to SSL_SESSION *session member here? Any other tool suggestions?

Useful links to OpenSSL source code:

int SSL_connect(SSL *s)

SSL structure

SSL_SESSION *session member in SSL

SSL_SESSION structure

3
  • Try looking at pykd. See this – sudhackar Nov 22 '20 at 15:47
  • 1
    @sudhacker does pykd work on x64dbg i wasn't aware of that – blabb Nov 22 '20 at 17:11
  • @blabb OP was looking for suggestions to other tools too. – sudhackar Nov 23 '20 at 4:27
-1

I would use the x64dbg methods to add a custom type:

  1. You can do this using a combination of these commands:
  • DataUnknown
  • DataByte/db
  • DataWord/dw
  • DataDword/dw
  • DataFword
  • DataQword/dq
  • DataTbyte
  • DataOwordD
  • DataMmword
  • DataXmmword
  • DataYmmword
  • DataFloat/DataReal4/df
  • DataDouble/DataReal8
  • DataLongdouble/DataReal10
  • DataAscii/da
  • DataUnicode/du
  • DataCode/dc
  • DataJunk
  • DataMiddle
  • AddType
  • AddStruct
  • AddUnion
  • AddMember
  • AppendMember
  • AddFunction
  • AddArg
  • AppendArg
  • SizeofType
  • VisitType
  • ClearTypes
  • RemoveType
  • EnumTypes
  • LoadTypes
  • ParseTypes
  1. Create a type definition in types JSON example:

{ "types": [ { "type": "unsigned int", "name": "DWORD" }, { "type": "_FILETIME*", "name": "LPFILETIME" } ], "structs": [ { "name": "ST", "members": [ { "type": "char", "name": "a", "arrsize": 0, "offset": -1 }, { "type": "int", "name": "y", "arrsize": 0, "offset": -1 } ] }, { "name": "_FILETIME", "members": [ { "type": "DWORD", "name": "dwLoDateTime" }, { "type": "DWORD", "name": "dwHighDateTime" } ] }, { "name": "BLUB", "members": [ { "type": "short", "name": "c" }, { "type": "int", "name": "d", "arrsize": 2 } ] }, { "name": "TEST", "members": [ { "type": "int", "name": "a" }, { "type": "char", "name": "b" }, { "type": "BLUB", "name": "e" }, { "type": "int", "name": "f" } ] }, { "name": "POINTEE", "members": [ { "type": "int", "name": "n" }, { "type": "TEST", "name": "t" } ] }, { "name": "POINTER", "members": [ { "type": "int", "name": "x" }, { "type": "POINTEE*", "name": "next" }, { "type": "int", "name": "y" } ] }, { "name": "LIST_ENTRY", "members": [ { "type": "int", "name": "x" }, { "type": "LIST_ENTRY*", "name": "next" }, { "type": "int", "name": "y" } ] }, { "name": "STRINGTEST", "members": [ { "type": "const char*", "name": "str" }, { "type": "const wchar_t*", "name": "wstr" } ] } ], "unions": [ { "name": "UT", "members": [ { "type": "char", "name": "a" }, { "type": "short", "name": "b" }, { "type": "int", "name": "c" }, { "type": "long long", "name": "d" } ] } ], "functions": [ { "rettype": "int", "callconv": "cdecl", "noreturn": false, "name": "strcasecmp", "arguments": [ { "type": "const char*", "name": "s1" }, { "type": "const char*", "name": "s2" } ] } ] }

  1. Load a simple C header definition of the type

Once a type is imported you can use VisitType cmd to view it. Additional info: x64dbg type system Weekly Digest 14 - Types

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.