2

I've been playing around with recording packets being sent to and from applications on my pc.

Logically any program that sends or receives packets must have the encryption scheme used. So I'd like to try and find this in the code of a test application.

Can anyone advise on how to go about doing this? I unsure as to how to identify what lines of code are being called when, and even if I new this I can know exactly when the packets are created exactly. Any link to helpful software, tutorials etc. would be great!

P.S. First time asking on this site, let me know if/how I can improve the question.

2

This question is a bit broad, since it's not asking about a specific program, or a specific network packet you found. A better question would probably be "I have a program that sends network packets, but dumping the packets with wireshark doesn't produce anything readable. I assume the application is encrypting the packets, how can i investigate this"?

You say "Logically any program that sends or receives packets must have the encryption scheme used". This isn't true - your Web browser, FTP client, and many other programs send everything unencrypted. Unless you're using https in your browser, of course, and there's a lot of documentation about how that works.

So, let's assume you have a program, dump the network packets, and assume they're encrypted. So you'd like to know if there's any encryption code in your application. This is what signsrch is for; it detects if your program contains any constants that are used in standard encryption schemes like AES.

Next, you'll want a debugger like Ollydbg, or even IDA Pro, to further analyze the program. There are tons of tutorials out there that show how to use them. However, i won't recommend a specific one, since what is good for you depends very much on how much you know already - any recommendation would be very opinion-based, and we don't like opinion based answers on Stackexchange.

  • I'll have to spend a few days investigating this, but from my understanding this is the exact answer I was looking for! Thanks! – FraserOfSmeg Mar 3 '15 at 23:50
  • I've have a play with signsearch and it's come back with over 3,000 entries, any advice on how to proceed? – FraserOfSmeg Mar 4 '15 at 21:20
  • "Signsrch found over 3.000 entries in my program, how do i tell real finds from bogus ones", including a sample of 50, and possibly a link to the whole result file, would make a great new question. – Guntram Blohm supports Monica Mar 5 '15 at 7:28
  • Thanks, I didn't think of making it a new question, I'll get onto that this evening! – FraserOfSmeg Mar 6 '15 at 7:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.