I understand that this question will be rather vague, but I'm unsure how to process from here.

I'm trying to see how a key generator can be made.

I have been toying with IDA and managed to reconstruct an application key checking functions into C up to a point that I can check if a key is valid or not. This process uses a lot of bitwise operations such as shifting and masking which leaves me wondering how I can reverse that algo.

The validation steps are as follow :

  1. From the serial key, use a associative table that maps chars to other values
  2. From those values, use a block hashing with bitshift|bitmasks so that char[n] depends on char[n-1].
  3. Generate a key from hard coded values.
  4. Generate 2 tables with the result from 2. Table1 = Step2 encoded with Step3. Table2 is Table1 encoded with Step3
  5. Encode Step2 with tables from Step4, depending on some bitmasking.

So this whole thing is rather complicated. Furthermore there is constant loss of information so writing code with exact reverse order of operations is not possible (or I don't know how).

I put myself in the shoes of someone who wants to create this protection scheme. Generating serials from decoded output MUST be possible. Either this whole process is reversible, or there is a function that can act as a backdoor like thing to reverse it right away, which I strongly doubt.

Any idea on things that I should look for at this point?

  • 2
    If they used some kind of assymetric cryptography, then yes, there is a backdoor to reverse it, and no, you can't derive it from what you have, since you need the private key. Did you run signsrch over your binary to check if it's an implementation of a standard algorithm? Commented Dec 20, 2014 at 9:29
  • signsrch is an interesting tool that I didn't know about. It does identify many ciphers signatures but none in the area of interest
    – Eric
    Commented Dec 21, 2014 at 0:12


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.