11
votes
Accepted
How can I determine if a piece of code is an encryption algorithm?
TL;DR: What we have here is probably not an encryption algorithm, it is more likely a decompression loop, by the look of it. It simply does not do anything that could be considered even remotely ...
- 11.8k
11
votes
ZTE encrypted backup config file
Updated for August 2020:
The below information is accurate to the best of my knowledge. It has been used to decrypt config.bin on 2 different routers at the time of writing.
The obfuscated section ...
- 266
11
votes
Accepted
How do Enigma, Themida and VMProtect compare to each other?
Disclaimer: I do not work for any of the companies that make either of these pieces of software. All details shown are from my own personal research.
This comparison will only include the protectors ...
- 226
9
votes
Question about Keeloq - A car remote control standard
To create a full duplicate, able to generate valid transmission packets you'll need the following information:
Serial Number
Button press mapping
32 bit of KeeLoq encrypted data
See attached Figure ...
- 11.8k
8
votes
Accepted
Finding the encryption key in a binary - IDA Pro and how an S-box might be represented in the binary
Initialization of the forward S-box
As you probably saw in the source-code, the forward S-box is present several times and initialized at two different places.
The first time that the forward S-box ...
- 8,989
6
votes
Decoding New Jersey Driver's License Codes
In case you're still trying to figure this out, I've made some progress. With assistance from u/jccool5000 on reddit (post), who has a collection of over 900 samples mostly from Ontario. AFAIK, ...
- 61
6
votes
Accepted
Is there a way to find out which hash standard by studying the source code?
This is quite likely either a botched RIPEMD128 or something very similar, as otus also commented.
You wanted to know how to approach such a task so I'll explain what I did.
Typically, when trying ...
- 1,391
6
votes
Accepted
How can I identify how this string is being encoded so I can replicate it?
Edit: The encryption is Bitwise XOR with the key 0x04 (see the bottom of this answer)
The application uses a simple Substitution Cipher (Or, to be exact Caesar Cipher with shift 4) and then perform ...
- 8,989
5
votes
Accepted
Having keys and binary, how do I reverse/decrypt a stream encryption?
Good news, You're lucky!
What you're facing in front of you is a stream cipher. Why is that good? because the way stream ciphers are built makes them extremely easy to reverse - the decryption and ...
- 11.8k
5
votes
Decoding New Jersey Driver's License Codes
I don't see this above, but male or female is coded in as well. in the last five digits, the first 2 are month of birth. Males are 01-12. Females 50 is added. so the run from 51 (january) to 62 (...
- 51
5
votes
Accepted
How to get file back from generated sha256 checksum?
This is actually one of the main attributes of Cryptographic Hash Functions. As mentioned in the wiki page, they are designed so they cannot be reversed:
It is infeasible to generate a message from ...
- 11.8k
5
votes
Identification of AES portion code in binary
The best way to locate AES in a binary blob would be to locate first the AES S-box. It is specifically designed for AES and recommended by the NIST, so a standard AES must include it. Moreover, they ...
- 19.1k
5
votes
Accepted
McDonald's receipt codes
As suggested in a comment, the final character is indeed a check digit. It appears to be calculated using the Luhn algorithm with 25 as the base instead of 10.
Using the code in photo as an example:
...
- 283
4
votes
Accepted
Help deciphering binary that creates 3 passwords
Your code has a function at 0x400960 that looks like a main function, and, omitting all initialization (everything gets initialized to 0) and error checking, looks like this:
char input_file_buffer[...
- 13k
4
votes
How can I identify how this string is being encoded so I can replicate it?
Based on your examples, it looks like the strings are reversed and each byte is XORed with the byte 4. Here's a quick Perl one-liner to demonstrate this:
perl -lne 'print reverse($_) ^ ("\x04" x ...
- 346
4
votes
Accepted
TP-Link encrypted backup file TX-VG1530
It seems they also added compression there.
This utility seems to decode it: https://www.nirsoft.net/utils/router_password_recovery.html
Also, I'd just written my own decoder and encoder for it:
https:...
- 156
4
votes
Decrypting SQLite Database with key
There exists an official encryption addon for SQLite but from your description it sounds more like the data is simply stored encrypted in the blobs and the application decrypts it internally before ...
- 36.6k
3
votes
Accepted
Extract decrypted token from EXE
Since it is a crackme, I don't want to spoiler the solution, although I try to give some hint, which may help you.
The hash function may be MD5 using salt, modified IV or the hash function is used in ...
- 1,759
3
votes
ZTE encrypted backup config file
came across these keys and sharing
Known AES keys:
zxhn h118n ert5 - 'MIK@0STzKpB%qJZe'
zxhn h118n V2.1.3_ROSCNT? - 'MIK@0STzKpB%qJZf'
zxhn h168n v3 ...
- 51
3
votes
Obfuscated AES decryption assembly
I think you identified the purpose of the functions and its parameters correctly. So, the function sub_44d84 has four parameters: (<decryptionFunction=0x1>, <IV>, <bytesToDecrypt>, &...
- 1,759
3
votes
How can I generate the recovery password on a legacy system (Original company is out of business) running on my local machine?
There's not much information to go on, but I would probably try to proceed like this:
Figure out how the web server is running (e.g. what is the server process?) and where are the pages and any ...
- 36.6k
3
votes
Accepted
how can i Encrypt a decrypted zte zxhn h108n V2.5 config file?
You can use the zcu module to do this.
python examples/encode.py config.bin.xml out.bin --key 'GrWM2Hz<vz&f^5' --signature 'ZXHN H108N V2.5'
Full disclosure: I wrote the zcu module. It's ...
- 266
3
votes
Accepted
Strings weirdly split in binary
Shot in the dark: Maybe this text (or the whole binary image) is compressed. Think something like LZSS.
The fact that there is a mystery byte containing eight 1 bits, followed by eight literal and ...
- 258
3
votes
Accepted
Way to know if firmware is compressed
I believe it is not compressed or encrypted. Entropy of 0.8 is pretty poor for any decent encryption or compression. These regions are more likely to be code.
With this in mind, let's look at a ...
- 2,548
3
votes
RE Huawei HG8145V5 user credentials
It's probably AES. I saw config files at HG8245Hv5 and HG8245H5 and passwords are looking similar. A bit (just a bit:D) more info is here: https://the-infosec.com/2017/03/20/huawei-hg8245h-router-...
- 101
3
votes
Accepted
How can I retrieve the encryption key in this code?
The encryption key is stored in the variable f4800b. It comes out to the following byte array.
43, 57, 97, -68, -63, -61, -40, 9, 50, 87, -104, 101, 63, 34, -78, 60
The cipher algorithm used is ...
- 6,090
3
votes
Need help with ZTE router config.bin file decryption and encryption
You can use the zcu module (written by Mark Streetster) to decrypt/encrypt your config.bin file.
- 84
3
votes
Find Decryption algorithm of an encryption algorithm
Non-Invertibility (1)
It's definitely not invertible.
To see this you only need to consider the contents of tmp1 after 2 iterations of the first loop.
Let's unroll these 2 iterations (and, for ...
- 2,548
3
votes
Accepted
How can I decrypte the data in this SQLite Database file
You can open that file using SQLiteStudio to get that information.
Steps:
Download SQLiteStudio and install it
Drag the file (Strong.isa_lex) onto the left sidebar in SQLiteStudio and click OK
Double-...
- 66
3
votes
Decrypt the cookies stored by the MS Teams desktop client
Just so you know, I think this has already been done - https://github.com/sleuthkit/autopsy_addon_modules/tree/master/IngestModules/Microsoft_Teams_Parser
You could just browse the code at https://...
- 796
Only top scored, non community-wiki answers of a minimum length are eligible