0

I have retrieve a code file related to security topic, that contains a piece of code to protect harcoded value of RSA key against static analysis:

 // Byte values of encrypted key
 //121, 217, 79, 9, 233, 193, [...]

void GenerateKey(char *X){
X[30]=(char)((X[30]+91)&0xFF);X[5]=(char)(((X[5]-23)-X[27])&0xFF);X[13]=(char)(((X[13]&X[5])^118)&0xFF);
X[22]=(char)((X[22]|147)&0xFF);X[0]=(char)(((X[0]-X[0])|77)&0xFF);X[10]=(char)(((X[10]|X[27])+159)&0xFF);
X[6]=(char)(((X[6]+207)+X[20])&0xFF);X[24]=(char)(((X[24]+86)^X[10])&0xFF);X[24]=(char)(((X[24]&X[1])&X[21])&0xFF);
X[22]=(char)(((X[22]-X[22])-X[29])&0xFF);X[16]=(char)(((X[16]+X[21])+27)&0xFF);X[2]=(char)((X[2]-6)&0xFF);
[...]
}

I want to know if it exists tools to generate automatically such of code from a key value (or other kind of static buffer data) ? Or what is the 'algorithm' to write it manually ?

My question is more for my own culture than for use in a production project.

1
  • Hi and welcome to RE.SE. For starters this is borderline off-topic, but this venue sort of makes sense for the topic. Do you mean something like this but for arbitrary buffers? It's security by obscurity for sure, because once - as a reverse engineer - I have figured out the the function (fingerprints exist for the usual libraries) taking the key as input I'll instrument/patch/break at this location to get the RSA key proper.
    – 0xC0000022L
    Sep 30 '21 at 15:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.