8
votes
Accepted
Reversing encoding of a RSA public key
00040000 looks like a 32 bit value representing the length of the data.
If we decode it in little-endian we get 1024:
sage: int.from_bytes(bytes.fromhex('00040000'), 'little')
1024
I'm assuming this ...
- 196
6
votes
Accepted
Is there a way to find out which hash standard by studying the source code?
This is quite likely either a botched RIPEMD128 or something very similar, as otus also commented.
You wanted to know how to approach such a task so I'll explain what I did.
Typically, when trying ...
- 1,331
6
votes
Reverse-engineering a tough-to-crack video game save-file checksum
Like others I would recommend trying to get the assembly code that computes the checksum. If you obtain that the rest is easy.
However sometimes that can be very hard to obtain, so here are some tips ...
- 231
5
votes
Identification of AES portion code in binary
The best way to locate AES in a binary blob would be to locate first the AES S-box. It is specifically designed for AES and recommended by the NIST, so a standard AES must include it. Moreover, they ...
- 18k
5
votes
Accepted
Identifying cryptography algorithm
You can always feed the original binary to IDA and use the plugin Findcrypt2 to identify the algorithms used. Other than this the Kanal plugin for PeiD can also detect cryptography used.
Another tool ...
- 5,850
4
votes
Accepted
Modifying a binary save-data file for a video game with a CRC/Checksum check
This is quite hard question to answer due to variables within reverse engineering.
I would recommend you start off with:
Start game
Get some coins or whatever is saved then save the game.
Restart ...
- 467
4
votes
Accepted
Having keys and binary, how do I reverse/decrypt a stream encryption?
Good news, You're lucky!
What you're facing in front of you is a stream cipher. Why is that good? because the way stream ciphers are built makes them extremely easy to reverse - the decryption and ...
- 11.3k
4
votes
Protect a key from being recovered by decompilation
Here are some thoughts on the fundamental problem and a possible solution; even if the full system goes way beyond your dev budget, some key ideas might still be useful for fashioning your own ...
- 1,940
4
votes
Unknown CRC calculation
MED17 functional description docs will help with overview of the EEP handler, but not the checksum routine.
Usually it is best to go through the front door with coding tools rather than try to change ...
- 133
4
votes
Generating a key for a simple algorithm
Well, the equation is pretty simple, you say that the hashing is done through the following formula:
v5 = serial[6] + serial[0] - serial[7] - serial[2];
LOBYTE(v5) = serial[1];
v8 = serial[3] + v5 - ...
- 18k
3
votes
Accepted
Is this firmware using a substitution cipher?
The first two lines suggest a string containing all hexadecimal digits, first line lower case, second line upper case. If this assumption holds, then the two lines read
0123456789abcdef
...
- 1,804
3
votes
Generating a key for a simple algorithm
expanding a bit on the answer by perror and my initial hypothesis
the result for the provided input string "abcdefgh" would result in "b+d-e = f"
providing constraints for input string z3 indeed ...
- 14.8k
3
votes
Which plugin for identifying crypto algorithms in IDA Pro 6.9?
Try IDAsignsrch, or the original commandline version.
- 34.6k
3
votes
Malware checks for hwid
It's base64. One entry per line. Entries look like they're padded to 0x10. So after base64 decoding the data is probably encrypted by a block cipher with 128-bit block size. Maybe AES. At this stage ...
- 5,551
2
votes
Understanding a messengers protocol encryption
Just as an example, consider the source code for AES at https://polarssl.org/aes-source-code. This has various tables, one of which is the Forward S-Box, FSb - which should be the same in all AES ...
- 12.6k
2
votes
Accepted
How the author found the initialization vector for the AES CBC whatsapp CRYPT5 db uses?
It doesn't seem to be on the IDA snapshot. You probably identified the right part of the program flow to set the initial key array. and assumed that the left part should have something to do with the ...
- 12.6k
2
votes
Reverse decryption algorithm
Do you have any more information, especially, one or two examples for buEncryptKey? Is that a prime number?
The reason i'm asking is: your hash_func is a modulo function, it calculates (serial*...
- 12.6k
2
votes
Accepted
How the signature level set to the process in Windows 8?
See http://2012.ruxconbreakpoint.com/assets/Uploads/bpx/alex-breakpoint2012.pdf:
So the signing level is embedded in the signed image's (file's) certificate. There are no special flags passed to ...
- 20.4k
2
votes
Accepted
Reverse Engineering Crypto Methods
The crypto definitely isn't a "good" one. Check what happens in your nextDecrypt function.
The nextDecrypt function
There's a variable at ebx+0x200 which gets loaded into edx. This variable gets ...
- 12.6k
2
votes
Help me understand how to actually break an XOR/Vigenère cipher
When it comes to break some encrypted texts, you have to take a few hypothesis and check it with caution (it may make you loose a lot of time... believe me).
The first Base64 decoding seems to be ...
- 18k
2
votes
Is it possible to recover the key to a decrypted file?
From my limited cryptographical knowledge and a quick Google search to confirm it, no.
This would be a known-plaintext attack and AES is engineered to be resistant to it.
- 1,331
1
vote
Determining the hash algorithm used
Lots of possibilities, for all we know there's a chance that some "other" salt is used or that either the password or the salt or both are preprocessed in some way. Additionally there could be ...
1
vote
RSA Decryption?
From here the structure of a private key looks like
RSAPrivateKey ::= SEQUENCE {
version Version,
modulus INTEGER, -- n
publicExponent INTEGER, -- e
privateExponent ...
- 2,345
1
vote
Running machine code that I need to execute with arguments. How?
I can see three ways to do that:
Using IDA's AppCall functionality to call that function from within IDA's console.
Spawning a debugger (x64, olly) and debug any process, find an empty region in ...
- 11.3k
1
vote
Running machine code that I need to execute with arguments. How?
This should work, i think i didnt miss anything.
Would be nice to know at least a few expected inputs and outputs for comparison.
Also not sure if the call 0xffffffffffffff38 would do anything to ...
- 586
1
vote
How can I debug this binary (which I suspect does encryption)?
If you have the binary file, for sure you can debug it. I suggest you to use gdb for debug it.
$ gdb your_program
(gdb) b main
(gdb) r
I suggest you to insert some breakpoint in the fuctions that ...
- 299
1
vote
Unknown CRC calculation
A9 68 01 00 FF 7F 00 80 FF 7F 00 80 FF 7F 00 80
FF 7F 00 80 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
...
1
vote
How would you protect this Crypter?
There is a thing that might help you in modern crypto research, it is called white-box cryptography and relatively good Q&A article resides here .
Generally speaking if the key exists sometimes in ...
- 7,710
1
vote
Accepted
Debug an application for analyzing file decryption
I wanted to know if there is a good debugger for windows that I can
use
OllyDbg v2 is a good debugger for Windows.
- 20.4k
1
vote
Which plugin for identifying crypto algorithms in IDA Pro 6.9?
I was going to recommend IDAScope but it is broken in 6.9 as well.
PySide has been dropped by IDA in favor of PyQT in 6.9.
Edit:
Thanks to Daniel Plohmann, the plugin now supports IDA 6.9.
You ...
- 702
Only top scored, non community-wiki answers of a minimum length are eligible