How to found signature XTEA for Lua

Question

I found an dynamic link library, which is available for download at the following link: [libgame.so] (https://easyupload.io/oh94nx)

I found the function responsible for decrypting xtea: (https://pastebin.com/PVS8YXyV)

I found the function responsible for the encryption of xtea:(https://pastebin.com/jgreUAkj)

i would like to find try to find the key to xtea, can someone recommend a tool to me or have you already had experience with xtea and can help me find the xtea key?

i have tried and cannot get a valid signature for lua xtea implementation.

Answer 1

You can try using the plugin:

• FindCrypt Available for free on the Hex-Rays website, there is also an implementation that uses yara
• findcrypt-yara

I have tested both and they do the job very well, with them it is possible to find possible encryption key in addition to the most common cryptographic patterns used by developers, assuming that the key may be in the dynamic link library, consider also doing an analysis in the main software that calls, and in the last case try:

• Hooking this xtea function and intercepting the parameters of its call will make it easy to find the key.

I recommend you try SubHook for this task, maybe if you provide the architecture I can specifically help hook it.