For my own personal curiosity and development (building a bit of code mimicking the protocol), I am trying to figure out what the communication protocol encryption is made out of in a particular chat application for Windows.
Based on what I know from some years ago where somebody managed to reverse engineer the encryption, it uses - at least AES encryption and some XOR´ing. It´s been updated many times since then though, and when I try to run it through
signsrch, there are many references in it compared to the old version.
So, I have tried to read what I could find about how one identifies encryption methods within an application, and so far I have come to the point where a breakpoint is triggered in Ollydbg whenever I´m trying to send something (login and password).
But now, I'm lost...
Should I be looking through the stack to try finding pure ASCII showing the string I entered before it getting encrypted or what ?
Also, it puzzles me that the addresses showing in
signsrch seem not to be the same as the addresses in the application when viewing it in Ollydbg: As far as I have understood, the addresses are pointing to various encryption signatures, but those addresses - in Ollydbg - are just assembly commands.
Would anybody be so kind to give me a bit of advice on this subject?