1

I found an dynamic link library, which is available for download at the following link: [libgame.so] (https://easyupload.io/oh94nx)

I found the function responsible for decrypting xtea: (https://pastebin.com/PVS8YXyV)

I found the function responsible for the encryption of xtea:(https://pastebin.com/jgreUAkj)

i would like to find try to find the key to xtea, can someone recommend a tool to me or have you already had experience with xtea and can help me find the xtea key?

i have tried and cannot get a valid signature for lua xtea implementation.

4
  • do you want to make sure your binary uses xtea, or do you want to find the xtea key?
    – Happy
    Oct 21 '21 at 13:28
  • I can improve your question and answer if you provide this information to me.
    – Happy
    Oct 21 '21 at 13:29
  • I want find xtea key
    – Kdo plane
    Oct 21 '21 at 21:17
  • I improved your question a little to try to help you find your answer, do you by any chance know what the architecture is? is it armbi or equivalent?
    – Happy
    Oct 22 '21 at 11:26
1

You can try using the plugin:

  • FindCrypt Available for free on the Hex-Rays website, there is also an implementation that uses yara
  • findcrypt-yara

I have tested both and they do the job very well, with them it is possible to find possible encryption key in addition to the most common cryptographic patterns used by developers, assuming that the key may be in the dynamic link library, consider also doing an analysis in the main software that calls, and in the last case try:

  • Hooking this xtea function and intercepting the parameters of its call will make it easy to find the key.

I recommend you try SubHook for this task, maybe if you provide the architecture I can specifically help hook it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.