0

These function are used to decrypt with AES and there is Decrypt by CRC and I assume that crc is used for data checksums, I have qemu-mipsel and my question for u is how could I discover from where does this function get key

;  function: CSPDBGetFileEncryKey at 0x4fd9d0 -- 0x4fda70
0x4fd9d0:   3c 1c 00 12     lui $gp, 0x12
0x4fd9d4:   27 9c c3 70     addiu $gp, $gp, 0xffffffffffffc370
0x4fd9d8:   03 99 e0 21     addu $gp, $gp, $t9
0x4fd9dc:   27 bd ff d8     addiu $sp, $sp, 0xffffffffffffffd8
0x4fd9e0:   af bf 00 24     sw $ra, 0x24 ( $sp )
0x4fd9e4:   af b2 00 20     sw $s2, 0x20 ( $sp )
0x4fd9e8:   af b1 00 1c     sw $s1, 0x1c ( $sp )
0x4fd9ec:   af b0 00 18     sw $s0, 0x18 ( $sp )
0x4fd9f0:   af bc 00 10     sw $gp, 0x10 ( $sp )
0x4fd9f4:   00 80 88 21     addu $s1, $a0, $zero
0x4fd9f8:   10 80 00 16     beq 0x4fda54  <CSPDBGetFileEncryKey+0x84>, $zero, 0x4fda54  <CSPDBGetFileEncryKey+0x84>
0x4fd9fc:   00 a0 80 21     addu $s0, $a1, $zero
0x4fda00:   10 a0 00 15     beq 0x4fda58  <CSPDBGetFileEncryKey+0x88>, $zero, 0x4fda58  <CSPDBGetFileEncryKey+0x88>
0x4fda04:   24 02 ff ff     addiu $v0, $zero, 0xffffffffffffffff
0x4fda08:   8f 92 89 9c     lw $s2, 0xffffffffffff899c ( $gp )
0x4fda0c:   8f 99 93 54     lw $t9, 0xffffffffffff9354 ( $gp )
0x4fda10:   03 20 f8 09     jalr $t9
0x4fda14:   26 44 00 b0     addiu $a0, $s2, 0xb0
0x4fda18:   8f bc 00 10     lw $gp, 0x10 ( $sp )
0x4fda1c:   10 40 00 0d     beq 0x4fda54  <CSPDBGetFileEncryKey+0x84>, $zero, 0x4fda54  <CSPDBGetFileEncryKey+0x84>
0x4fda20:   02 20 20 21     addu $a0, $s1, $zero
0x4fda24:   8f 99 89 7c     lw $t9, 0xffffffffffff897c ( $gp )
0x4fda28:   00 00 28 21     addu $a1, $zero, $zero
0x4fda2c:   03 20 f8 09     jalr $t9
0x4fda30:   02 00 30 21     addu $a2, $s0, $zero
0x4fda34:   02 20 20 21     addu $a0, $s1, $zero
0x4fda38:   26 45 00 b0     addiu $a1, $s2, 0xb0
0x4fda3c:   8f bc 00 10     lw $gp, 0x10 ( $sp )
0x4fda40:   8f 99 8b 8c     lw $t9, 0xffffffffffff8b8c ( $gp )
0x4fda44:   03 20 f8 09     jalr $t9
0x4fda48:   26 06 ff ff     addiu $a2, $s0, 0xffffffffffffffff
0x4fda4c:   10 00 00 02     beq $zero, $zero, 0x4fda58  <CSPDBGetFileEncryKey+0x88>
0x4fda50:   00 00 10 21     addu $v0, $zero, $zero
0x4fda54:   24 02 ff ff     addiu $v0, $zero, 0xffffffffffffffff
0x4fda58:   8f bf 00 24     lw $ra, 0x24 ( $sp )
0x4fda5c:   8f b2 00 20     lw $s2, 0x20 ( $sp )
0x4fda60:   8f b1 00 1c     lw $s1, 0x1c ( $sp )
0x4fda64:   8f b0 00 18     lw $s0, 0x18 ( $sp )
0x4fda68:   03 e0 00 08     jr $ra
0x4fda6c:   27 bd 00 28     addiu $sp, $sp, 0x28

Here you can download whole disassembly for this file and here you can download mips binary if you would like to take a look

  • I cant run it with qemu sudo chroot . ./qemu-mips-static ./cspd qemu: uncaught target signal 11 (Segmentation fault) - core dumped You can find it here with all libs I will try to compile qemu without threding – Vido Jul 26 '15 at 18:30
  • Add comments to each line of which you do know what it does. Research the commands of which you don't. Draw lines from/to jump adresses. Replace register names with functional names. Repeat until done. – usr2564301 Jul 26 '15 at 21:17
  • I did tried to do that, so we have first instruction lui $gp, 0x12 and in google I got this question as solution, beside that what meaning has adding 0x12 to $gp it does not make any seance :) Tnx for suggestion I will try to complete it, and if I know what those instruction mean and do I would not ask this for nothing :) – Vido Jul 27 '15 at 0:57
2

First of all, it is impossible to say where the key taken from on a basis of your snippet because it is incomplete.

You have 3 indirect calls here, and you can see it by

jalr $t9

Opening it in IDA gives you a bit more readable picture:

.text:004FD9D0                 .globl CSPDBGetFileEncryKey
.text:004FD9D0 CSPDBGetFileEncryKey:                    # CODE XREF: sub_50D040+18Cp
.text:004FD9D0                                          # encry+158p
.text:004FD9D0                                          # DATA XREF: ...
.text:004FD9D0
.text:004FD9D0 var_18          = -0x18
.text:004FD9D0 var_10          = -0x10
.text:004FD9D0 var_C           = -0xC
.text:004FD9D0 var_8           = -8
.text:004FD9D0 var_4           = -4
.text:004FD9D0
.text:004FD9D0                 li      $gp, 0x11C370
.text:004FD9D8                 addu    $gp, $t9
.text:004FD9DC                 addiu   $sp, -0x28
.text:004FD9E0                 sw      $ra, 0x28+var_4($sp)
.text:004FD9E4                 sw      $s2, 0x28+var_8($sp)
.text:004FD9E8                 sw      $s1, 0x28+var_C($sp)
.text:004FD9EC                 sw      $s0, 0x28+var_10($sp)
.text:004FD9F0                 sw      $gp, 0x28+var_18($sp)
.text:004FD9F4                 move    $s1, $a0
.text:004FD9F8                 beqz    $a0, loc_4FDA54
.text:004FD9FC                 move    $s0, $a1
.text:004FDA00                 beqz    $a1, loc_4FDA58
.text:004FDA04                 li      $v0, 0xFFFFFFFF
.text:004FDA08                 la      $s2, g_tDBPdtIf
.text:004FDA0C                 la      $t9, strlen
.text:004FDA10                 jalr    $t9 ; strlen
.text:004FDA14                 addiu   $a0, $s2, (unk_619C78 - 0x619BC8)
.text:004FDA18                 lw      $gp, 0x28+var_18($sp)
.text:004FDA1C                 beqz    $v0, loc_4FDA54
.text:004FDA20                 move    $a0, $s1
.text:004FDA24                 la      $t9, memset
.text:004FDA28                 move    $a1, $zero
.text:004FDA2C                 jalr    $t9 ; memset
.text:004FDA30                 move    $a2, $s0
.text:004FDA34                 move    $a0, $s1
.text:004FDA38                 addiu   $a1, $s2, (unk_619C78 - 0x619BC8)
.text:004FDA3C                 lw      $gp, 0x28+var_18($sp)
.text:004FDA40                 la      $t9, strncpy
.text:004FDA44                 jalr    $t9 ; strncpy
.text:004FDA48                 addiu   $a2, $s0, -1
.text:004FDA4C                 b       loc_4FDA58
.text:004FDA50                 move    $v0, $zero
.text:004FDA54  # ---------------------------------------------------------------------------
.text:004FDA54
.text:004FDA54 loc_4FDA54:                              # CODE XREF: CSPDBGetFileEncryKey+28j
.text:004FDA54                                          # CSPDBGetFileEncryKey+4Cj
.text:004FDA54                 li      $v0, 0xFFFFFFFF
.text:004FDA58
.text:004FDA58 loc_4FDA58:                              # CODE XREF: CSPDBGetFileEncryKey+30j
.text:004FDA58                                          # CSPDBGetFileEncryKey+7Cj
.text:004FDA58                 lw      $ra, 0x28+var_4($sp)
.text:004FDA5C                 lw      $s2, 0x28+var_8($sp)
.text:004FDA60                 lw      $s1, 0x28+var_C($sp)
.text:004FDA64                 lw      $s0, 0x28+var_10($sp)
.text:004FDA68                 jr      $ra
.text:004FDA6C                 addiu   $sp, 0x28
.text:004FDA6C  # End of function CSPDBGetFileEncryKey
.text:004FDA6C

where all those indirect functions look like memset, strlen and strncpy, so the key is somewhere in memory when this function is called.

I understand that it is not an answer for the question you asked, but hope it helps.

In addition I'd suggest to use something like retargetable decompiler. This will probably make this task easier (You'll probably need to register there to extend allowed decompilation time and specify that you want to decompile unreachable code.)

  • Its complex and I understand that, before posting question I did tried to follow flow of program and on those jumps I lose track where to go next. For example beq 0x4fda54 <CSPDBGetFileEncryKey+0x84>, $zero, 0x4fda54 <CSPDBGetFileEncryKey+0x84> in middle of instructions I have function name+hex value so it means that should go at beginning of function or if not what "value" has name of function, I did included results from retarg. dec (non reg. user). I dont have IDA pro and your "output" represent same thing in different way. I will include funcs which are missing tnx for helping out – Vido Jul 27 '15 at 17:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.