8 votes
Accepted

Reversing encoding of a RSA public key

00040000 looks like a 32 bit value representing the length of the data. If we decode it in little-endian we get 1024: sage: int.from_bytes(bytes.fromhex('00040000'), 'little') 1024 I'm assuming this ...
user avatar
  • 196
6 votes
Accepted

Is there a way to find out which hash standard by studying the source code?

This is quite likely either a botched RIPEMD128 or something very similar, as otus also commented. You wanted to know how to approach such a task so I'll explain what I did. Typically, when trying ...
user avatar
6 votes

Reverse-engineering a tough-to-crack video game save-file checksum

Like others I would recommend trying to get the assembly code that computes the checksum. If you obtain that the rest is easy. However sometimes that can be very hard to obtain, so here are some tips ...
user avatar
  • 231
5 votes

Identification of AES portion code in binary

The best way to locate AES in a binary blob would be to locate first the AES S-box. It is specifically designed for AES and recommended by the NIST, so a standard AES must include it. Moreover, they ...
user avatar
  • 18k
5 votes
Accepted

Identifying cryptography algorithm

You can always feed the original binary to IDA and use the plugin Findcrypt2 to identify the algorithms used. Other than this the Kanal plugin for PeiD can also detect cryptography used. Another tool ...
user avatar
  • 5,850
4 votes
Accepted

Modifying a binary save-data file for a video game with a CRC/Checksum check

This is quite hard question to answer due to variables within reverse engineering. I would recommend you start off with: Start game Get some coins or whatever is saved then save the game. Restart ...
user avatar
  • 467
4 votes
Accepted

Having keys and binary, how do I reverse/decrypt a stream encryption?

Good news, You're lucky! What you're facing in front of you is a stream cipher. Why is that good? because the way stream ciphers are built makes them extremely easy to reverse - the decryption and ...
user avatar
  • 11.3k
4 votes

Protect a key from being recovered by decompilation

Here are some thoughts on the fundamental problem and a possible solution; even if the full system goes way beyond your dev budget, some key ideas might still be useful for fashioning your own ...
user avatar
  • 1,940
4 votes

Unknown CRC calculation

MED17 functional description docs will help with overview of the EEP handler, but not the checksum routine. Usually it is best to go through the front door with coding tools rather than try to change ...
user avatar
4 votes

Generating a key for a simple algorithm

Well, the equation is pretty simple, you say that the hashing is done through the following formula: v5 = serial[6] + serial[0] - serial[7] - serial[2]; LOBYTE(v5) = serial[1]; v8 = serial[3] + v5 - ...
user avatar
  • 18k
3 votes
Accepted

Is this firmware using a substitution cipher?

The first two lines suggest a string containing all hexadecimal digits, first line lower case, second line upper case. If this assumption holds, then the two lines read 0123456789abcdef ...
user avatar
  • 1,804
3 votes

Generating a key for a simple algorithm

expanding a bit on the answer by perror and my initial hypothesis the result for the provided input string "abcdefgh" would result in "b+d-e = f" providing constraints for input string z3 indeed ...
user avatar
  • 14.8k
3 votes

Which plugin for identifying crypto algorithms in IDA Pro 6.9?

Try IDAsignsrch, or the original commandline version.
user avatar
  • 34.6k
3 votes

Malware checks for hwid

It's base64. One entry per line. Entries look like they're padded to 0x10. So after base64 decoding the data is probably encrypted by a block cipher with 128-bit block size. Maybe AES. At this stage ...
user avatar
2 votes

Understanding a messengers protocol encryption

Just as an example, consider the source code for AES at https://polarssl.org/aes-source-code. This has various tables, one of which is the Forward S-Box, FSb - which should be the same in all AES ...
user avatar
2 votes
Accepted

How the author found the initialization vector for the AES CBC whatsapp CRYPT5 db uses?

It doesn't seem to be on the IDA snapshot. You probably identified the right part of the program flow to set the initial key array. and assumed that the left part should have something to do with the ...
user avatar
2 votes

Reverse decryption algorithm

Do you have any more information, especially, one or two examples for buEncryptKey? Is that a prime number? The reason i'm asking is: your hash_func is a modulo function, it calculates (serial*...
user avatar
2 votes
Accepted

How the signature level set to the process in Windows 8?

See http://2012.ruxconbreakpoint.com/assets/Uploads/bpx/alex-breakpoint2012.pdf: So the signing level is embedded in the signed image's (file's) certificate. There are no special flags passed to ...
user avatar
2 votes
Accepted

Reverse Engineering Crypto Methods

The crypto definitely isn't a "good" one. Check what happens in your nextDecrypt function. The nextDecrypt function There's a variable at ebx+0x200 which gets loaded into edx. This variable gets ...
user avatar
2 votes

Help me understand how to actually break an XOR/Vigenère cipher

When it comes to break some encrypted texts, you have to take a few hypothesis and check it with caution (it may make you loose a lot of time... believe me). The first Base64 decoding seems to be ...
user avatar
  • 18k
2 votes

Is it possible to recover the key to a decrypted file?

From my limited cryptographical knowledge and a quick Google search to confirm it, no. This would be a known-plaintext attack and AES is engineered to be resistant to it.
user avatar
1 vote

Determining the hash algorithm used

Lots of possibilities, for all we know there's a chance that some "other" salt is used or that either the password or the salt or both are preprocessed in some way. Additionally there could be ...
1 vote

RSA Decryption?

From here the structure of a private key looks like RSAPrivateKey ::= SEQUENCE { version Version, modulus INTEGER, -- n publicExponent INTEGER, -- e privateExponent ...
user avatar
  • 2,345
1 vote

Running machine code that I need to execute with arguments. How?

I can see three ways to do that: Using IDA's AppCall functionality to call that function from within IDA's console. Spawning a debugger (x64, olly) and debug any process, find an empty region in ...
user avatar
  • 11.3k
1 vote

Running machine code that I need to execute with arguments. How?

This should work, i think i didnt miss anything. Would be nice to know at least a few expected inputs and outputs for comparison. Also not sure if the call 0xffffffffffffff38 would do anything to ...
user avatar
  • 586
1 vote

How can I debug this binary (which I suspect does encryption)?

If you have the binary file, for sure you can debug it. I suggest you to use gdb for debug it. $ gdb your_program (gdb) b main (gdb) r I suggest you to insert some breakpoint in the fuctions that ...
user avatar
1 vote

Unknown CRC calculation

A9 68 01 00 FF 7F 00 80 FF 7F 00 80 FF 7F 00 80 FF 7F 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ...
user avatar
1 vote

How would you protect this Crypter?

There is a thing that might help you in modern crypto research, it is called white-box cryptography and relatively good Q&A article resides here . Generally speaking if the key exists sometimes in ...
user avatar
  • 7,710
1 vote
Accepted

Debug an application for analyzing file decryption

I wanted to know if there is a good debugger for windows that I can use OllyDbg v2 is a good debugger for Windows.
user avatar
1 vote

Which plugin for identifying crypto algorithms in IDA Pro 6.9?

I was going to recommend IDAScope but it is broken in 6.9 as well. PySide has been dropped by IDA in favor of PyQT in 6.9. Edit: Thanks to Daniel Plohmann, the plugin now supports IDA 6.9. You ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible