17 votes
Accepted

How can I decode this php code?

I wrote a small Python script to deobfuscate the majority of the string obfuscation: import urllib import re php = urllib.urlopen("http://pastebin.com/raw.php?i=wVs8w44v").read() # Slight ...
user avatar
17 votes

How are Apple App Store Apps encrypted?

When you download an app from the App Store, Apple injects a special 4196 byte long header into the signed binary encrypted with the public key associated with your iTunes account. This public/...
user avatar
  • 605
12 votes
Accepted

Guessing CRC checksum algorithm

Got it. Here's how to calculate, using your first string as a simple example: 1f456e01 First, we rearrange the packet, omitting the checksum. 1f 01 Then prepend the values A3 02: a3 02 1f 01 ...
user avatar
  • 2,381
11 votes
Accepted

Finding out checksum algorithm

It's a big-endian CRC16 (polynomial 0x8005) of the data from the byte following the 0x82 up to and including the byte before the CRC. For example, for your last RX frame: 82 00 00 00 ff 00 00 00 01 ...
user avatar
  • 861
11 votes
Accepted

Decrypting IPA Binary on OS X

Currently you can't decrypt iOS apps without a device. The encryption keys are ultimately protected by an unknown key which is burned into the processor and cannot be extracted using software, that's ...
user avatar
  • 34.6k
11 votes
Accepted

How can I determine if a piece of code is an encryption algorithm?

TL;DR: What we have here is probably not an encryption algorithm, it is more likely a decompression loop, by the look of it. It simply does not do anything that could be considered even remotely ...
user avatar
  • 11.3k
9 votes

Question about Keeloq - A car remote control standard

To create a full duplicate, able to generate valid transmission packets you'll need the following information: Serial Number Button press mapping 32 bit of KeeLoq encrypted data See attached Figure ...
user avatar
  • 11.3k
8 votes

Reverse Engineering a Firmware. Someone can help me?

Finding: NGA_FW_CURRENT.BIN is a compressed Videx microchip firmware image file. Preliminary Remarks There is conflicting background information given in the comments about the file alleged to be ...
user avatar
  • 6,829
7 votes
Accepted

decoding blob into original file

The blob file is compressed with zlib, so you have to decompress it first. The first 4 bytes of the blob is the decompressed size and the compressed content start at 6th byte. After the decompression ...
user avatar
  • 1,731
7 votes
Accepted

Reverse engineer 4-bit CRC in LG IR packet

This seems to be a checksum, just as you state in your question, not a CRC as mentioned in the header. Group the values into blocks of 4 bits, add them, ignore overflow (in these examples, ignore ...
user avatar
7 votes

Guessing CRC checksum algorithm

I'd assume the first byte is a message type ID, the 2nd and 3rd bytes are checksum, and the rest is payload. As the game is probably an i386 game, the payload ought to be little-endian. Now, if we ...
user avatar
7 votes

How to decrypt encrypted script files for a game?

There are two noteworthy communities dedicated to reversing file formats with video games: XeNTaX and ZenHAX Both of them have their own respective applications used for creating scripts that unpack ...
user avatar
  • 2,144
7 votes
Accepted

How to decompile an exe file?

I have been wondering, if every program is based on machine code, can we not decompile a program until it hits machine code and make it up to real programming languages? This question is based on a ...
user avatar
  • 6,829
7 votes

Finding AES Key in binary using Ghidra and FindCrypt

FindCrypt is not supposed to find your key, it's supposed to find fixed, known constants associated with well-known cryptographic algorithms. You can see the byte patterns it's looking for in its ...
user avatar
  • 7,814
6 votes

Guessing CRC checksum algorithm

The checksum is very simple, as can be seen from the minimal difference in checksum between 11111111111111111111111111111 and 11111111111111111111111111112, the difference is 0x21 (33 in decimal). ...
user avatar
  • 415
5 votes

Decrypting firmware: Is there a true "format" to it, and how does it differ from decryping other files?

Wow to identify firmware format In old days the Intel HEX and bin Flash memory dump was used the firmware was usually copied to device by HW programer for specific IC or by ISP. HEX is very specific ...
user avatar
  • 1,374
5 votes
Accepted

Identifying cryptography algorithm

You can always feed the original binary to IDA and use the plugin Findcrypt2 to identify the algorithms used. Other than this the Kanal plugin for PeiD can also detect cryptography used. Another tool ...
user avatar
  • 5,850
5 votes
Accepted

AirPlay Mirroring decryption (FairPlay)

I have spent some time to look into Apple's airplay mirroring support, which is encrypted by fairplay protocol. After investigating serveral existing commercial applications I have finally managed to ...
user avatar
  • 66
5 votes

Animal Crossing: Pocket Camp .zdat File

The file does not appear to be obfuscated or encrypted in any way. The header appears to be trivial. I have included a description of the header for the .zdata you posted. The .unity3d files contained ...
user avatar
  • 326
5 votes
Accepted

Unknown game file decompress

it seems to be compressed in some way because you can read some plain text there This statement is contradictory. If the binary were compressed or encrypted in its entirety there would not be any ...
user avatar
  • 6,829
5 votes
Accepted

Stuck on XOR decryption of firmware

Well thanks to @IgorSkochinsky's suggestion, I found a disassembler for the Blackfin architecture in the pf0camino/cross-bfin-elf Docker image. Being in Docker meant it was easy to run and I didn't ...
user avatar
4 votes

How can I statically unpack a file packed with an unknown packer without executing it?

You can't. You don't know how the file is packed, the only thing you have is the unpacking code in the file. You could try running the file through an emulator like QEMU, so the unpacking takes place ...
user avatar
4 votes
Accepted

Reverse Engineering Quebec Canada PDF417 restaurant bills

From https://www.ctf.ca/ctfweb/Documents/PDF/2009ctj/09ctj4-ainsworth.pdf -- In addition to ensure the integrity of the information presented on the receipt, the solution designed by Revenu ...
user avatar
4 votes

How to find compressed or encrypted parts in a packed executable?

A good way to find compressed or encrypted parts in a binary is entropy investigation, as compressed and encrypted parts show a high degree of disorder (a value of 1 means maximum disorder). I can ...
user avatar
  • 1,804
4 votes
Accepted

Having keys and binary, how do I reverse/decrypt a stream encryption?

Good news, You're lucky! What you're facing in front of you is a stream cipher. Why is that good? because the way stream ciphers are built makes them extremely easy to reverse - the decryption and ...
user avatar
  • 11.3k
4 votes

Decrypt / Decode / Decompress Proprietary File

I took a look at the empty template file that you provided. The file has a very high entropy which indicates that it's probably encrypted and not compressed. The header in the file could be a lot of ...
user avatar
  • 171
4 votes

Extract decrypted Assembly-CSharp.dll from APK via IDA

I think the solution is a very simple one, with one small tweak. To decrypt the file, XOR the encrypted data with the bytes 0xFCC6DC7FDCC7DFE0 and you will get the unencrypted file. You can see this ...
user avatar
  • 501
4 votes

Unknown CRC calculation

MED17 functional description docs will help with overview of the EEP handler, but not the checksum routine. Usually it is best to go through the front door with coding tools rather than try to change ...
user avatar
4 votes

how to find the encryption algorithm?

First, I have to say several things don't quite add up in the decompilation, and I often find it easier to understand disassembly than decompilation Let's start with the function doing most of the ...
user avatar
  • 11.3k
4 votes
Accepted

how to find the encryption algorithm?

All the credit for this this answer should go to the @NirIzr and @Avery3R. Here is a python script that implements the xoring mentioned by these kind people: import urllib import binascii data = "%...
user avatar
  • 7,710

Only top scored, non community-wiki answers of a minimum length are eligible