Skip to main content
6 votes

Is it possible to build an equivalent function just looking at the input and output of the original function?

Your problem seems to be related to what Sibyl aim at doing (https://github.com/cea-sec/Sibyl). It tries based on the side effects of the function (return value, memory writes, ...) to identify a ...
Caroline's user avatar
  • 206
6 votes
Accepted

Is there a way to find out which hash standard by studying the source code?

This is quite likely either a botched RIPEMD128 or something very similar, as otus also commented. You wanted to know how to approach such a task so I'll explain what I did. Typically, when trying ...
Johann Aydinbas's user avatar
6 votes
Accepted

Identification of RF hash algorithm

As explained there for a similar problem, facing an unknown Frame Check Sequence, the first thing should be to determine if it is an affine function of the frame data, for the sense that has in ...
fgrieu's user avatar
  • 186
5 votes
Accepted

How to get file back from generated sha256 checksum?

This is actually one of the main attributes of Cryptographic Hash Functions. As mentioned in the wiki page, they are designed so they cannot be reversed: It is infeasible to generate a message from ...
NirIzr's user avatar
  • 11.8k
5 votes

Is it possible to build an equivalent function just looking at the input and output of the original function?

If you have all the possible input and all the expected outputs, and they're not indistinguishable from encrypted/compressed data, you can find more efficient storage mechanisms than just having a ...
Luaan's user avatar
  • 151
4 votes

Is it possible to build an equivalent function just looking at the input and output of the original function?

Unless you try all the input possibilities, as you suggested, you can only get an approximation of the function. This is basically one of the basic problems in the machine learning field, so I would ...
frollo's user avatar
  • 141
4 votes
Accepted

Understanding hashing in cookies

The two vertical bars hints towards 3 separate parts of the cookie. It seems that the first part is a base64 encoded json object. For the first part of the cookie no. 1 that would be: ...
Masande's user avatar
  • 66
3 votes

CRC32 reverse engineer without knowing parameters, but knowing the input value

I wanted to give this a try because it seemed interesting but I did not succeed. Still, maybe this will lead you in the right direction for further tests. I started reading some introduction ...
Johann Aydinbas's user avatar
3 votes
Accepted

Trying to reverse function to generate certain color strings from an HMAC signature - decompiled code LOOKS right, but my results differ

you possibly have an extra 0 in the month https://www.freeformatter.com/hmac-generator.html#ad-output 2017727 87gs4 c698c872565f2f1021645993fe29eff6adba41cb1260b7e671fc1752ae8d94a0 it is padded ...
blabb's user avatar
  • 16.4k
3 votes

Is MD5 hashing of files a valid method of creating an anti-virus program?

Not in the long run. Hashing of certain parts of files is still used to push data updates quickly when a new malicious sample shows up in the wild, to get the clients protected as soon as possible. ...
Calmarius's user avatar
  • 171
2 votes

How to detect md5 and sha256?

You can usually spot MD5 quite easily by looking for a huge function. It tends to be the biggest function in the whole binary. That's the MD5_Process() (if I recall the name correctly) function which ...
Johann Aydinbas's user avatar
2 votes

How to debug an obfuscated self hashing program?

If your suggestion that "the obfuscated code actually reads the file and checks the kind of checksum of it" is correct you can do the following (or at least that's the order of the actions I'...
w s's user avatar
  • 8,508
2 votes

How is lite hash rate (LHR) of Nvidia implemented?

This is mostly speculative, since Nvidia didn't go into details about the implementation details. All I could find was this quote: RTX 3060 software drivers are designed to detect specific attributes ...
NirIzr's user avatar
  • 11.8k
2 votes

Is it possible to build an equivalent function just looking at the input and output of the original function?

This problem essentially describes the field of sequential analysis coupled with curve fitting. If you are able to make some assumptions about the inputs to the secret function that your model needs ...
Will's user avatar
  • 121
2 votes

Anti-patching checksum

For finding the software part calculating the hash value, just some possibilities: Look for "magic numbers" in the code. Many CRC, SHA etc standard checksum calculators could be recognized. ...
josh's user avatar
  • 1,974
2 votes
Accepted

Overclock CPU in BIOS - ARM/C/C++/Py

How to change the clock-speed of a microprocessor using inline assembly language General procedures for utilizing assembly language to overclock a microprocessor are : Ascertain the CPU and ...
raheel0x01's user avatar
1 vote
Accepted

Which function or file is responsible for initialization of g_37HashSeed

It looks like the g_37HashSeed variable is initialized in the function IppInitSharedHashContext, in the file tcpip.sys: IppInitSharedHashContext proc near sub rsp, 28h or edx, 0FFFFFFFFh mov ...
anonymous panda's user avatar
1 vote

How to know which hashing algorithm is being used?

In most cases the hash algorithm is known beforehand or can be guessed from a short list. For example, RSA signatures usually use some version of the PKCS standard which either specifies the hash or ...
Igor Skochinsky's user avatar
  • 36.7k
1 vote
Accepted

How to know which hashing algorithm is being used?

The hash file algorithm is (usually) sent together with the file, i.e. Before sending a file, User1 uses a hashing algorithm to generate a checksum for a file. Then he/she sends it alongside the file ...
Irbis77's user avatar
  • 328
1 vote
Accepted

Log input data and resulting hash for CC_MD5 calls in an iOS app with Frida

The main problem of your code is that you expect the md parameter to be a string. In C the unsigned char * is not an indicator for a string. Instead it is often for storing binary data. In this case ...
Robert's user avatar
  • 1,057
1 vote

Tool to search known hash/encryption algo in files in Windows

You could run Yara with a set of crypto signatures. Is something like this what you are looking for?
knowmalware's user avatar
1 vote
Accepted

Identifying a very weak hash algorithm

I actually found the hash function today by reverse-engineering the game's code. Here it is, translated to Python: def hashFunction(data): h = -1 for c in data: if (c - 65) & ...
RoadrunnerWMC's user avatar
1 vote

Identifying a very weak hash algorithm

From your description, I suspect these are not hashes but just randomly-generated numerical IDs, incremented as new strings were added around the same place to the program (possibly because programmer ...
Igor Skochinsky's user avatar
  • 36.7k
1 vote

Reverse-engineer digest http authentication

So finally, I used Cycript and attached to the running app process, and consequently intercepted the private key in runtime.
Nikolay Derkach's user avatar
1 vote

Is MD5 hashing of files a valid method of creating an anti-virus program?

No form of hashing, when used alone, is a good way of developing an AV solution. While hashes can be useful for finding instances of a known sample across a network, heuristic and behavioural AV ...
Andy Dove's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible