Hot answers tagged

11

Yes, it's 2xAES3-like. Data is basically PCM, 8 channels per pair. See http://www.diyaudio.com/forums/digital-line-level/261683-suggestions-please-16-channel-24-bit-digital-audio-recorder-3.html Physical RJ45 pinout: 1: Ch 1-8 (TD+) 2: Ch 1-8 (TD-) 3: Ch 9-16 (TD+) 4: Vcc 5: Vcc 6: Ch 9-16 (TD-) 7: GND 8: GND 'Power over RJ45': Vcc is 15 volts DC (pins ...


9

First I would run some static analysis on the application such as Findcrypt or ProtectID and PEID's Kanal plugin to scan for known static values used in various encryption algorithms. If you find something, check which function accesses them with cross referencing (X in IDA, CTRL+r in olly) and you will get to the encryption function(s) or at least very near ...


5

Following OP's other questions, assuming Windows OS This can be achieved with many 3rd-party solutions for Windows, choose the one which fits best to your needs: Proxifier Proxifier allows network applications that do not support working through proxy servers to operate through a SOCKS or HTTPS proxy and chains. https://www.proxifier.com/ ...


4

Is it possible to identify a protocol in a pcap file? Yes, but this appears to be a proprietary protocol over TCP/IP. The first four bytes of every message is a 32-bit big-endian value that specifies the length of the following bytes in the message. The messages aren't encrypted, so you might be able to do some data carving. But if you really want to know ...


3

There is no automated way (as far as I know) for that. The most common approach is examining sender and receiver processes and their communications. Another thing is packet (or frame) doesn't matter if you don't mind about communication protocols. It is operating system's, hardware interface's and drivers' (or modules') business.Your interest is raw data ...


3

Looking at the files distributed with the software, the video playing part is done via Flowplayer, embedded in these files: assets/webthings/local_me.html assets/webthings/local_me_OSM.html assets/webthings/local_me_slowmo.html assets/webthings/local_me_with_file_select.html These functions also control updating the UI fields - apparently flowplayer ...


3

It may be the case that it's CBC-encrypted data, with the first field being a nonce. Or one of many other possibilities. Either way, as Guntram said in his comment above, you'd need to reverse engineer the software to determine how this data is parsed.


2

This specific pseudocode is actually regular C code because it doesn't access global variables and stack. You'll probably need to add some typedefs for basic types. Please note that this code should be compiled as 32 bit code (or any other where sizeof int is equal to sizeof of pointer for your specific system) to avoid problems with pointer sizes.


2

unsigned int seed=0x3412; unsigned int len=15; unsigned int vec1[] = { 0x5500,0x534D,0x3434,0x5149,0x0000,0x0000,0x0000,0x4F1F,0xDFF1,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000 // 0xC7CC }; unsigned int vec2[] = { 0x1602,0x534D,0x3130,0x3054,0x5147,0x0000,0x0000,0xC87F,0xA8F4,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000 // ...


2

The CRC is, as suspected, a fairly standard CRC16 with the polynomial 0x8005 (reflected: 0xA001). The only online calculators that I could find for this are: BobTech's (clear the 'reverse data bytes' and 'reverse CRC' check boxes) GHS Infotronic's (the link has polynomial and message "123456789" already inserted) The latter is particularly convenient for ...


2

From type == 0 you see that it writes to param_3 and reads from param_4. So those parameters must be pointers to output and input buffers respectively. In fact, if you change them to correct type (byte *), then I believe Ghidra should be able to simplify the rest of the code to easily understandable form. The part that modifies param_2 is a simple pseudo-...


1

solution ,first need to reverse imei array (without F in packet1) and need Addition byte by byte and output need to Addition with 31, thanks


1

I'm not sure if this will solve your issue, but have you tried using Charles Proxy with SSL Proxying enabled? Charles can perform a man-in-the-middle attack and get the contents of the applications's web request if the application is not using certificate pinning. I've only used the Mac version, but generally what you would do is install the Charles root ...


1

If you ignore the first constant byte (FC), all the other bytes add up to 00, ignoring overflow. In other words, to calculate the last byte, start with 00, subtract all bytes except the first FC (and the last one, obviously). Ignore underflow. The result is the last byte. Or, if that's easier in your programming language, start with 2000 (8192 decimal), ...


1

Others have provided clues about this particular protocol, so I'll just address the general mechanism of decoding a protocol. You have specified "wire" but this generic method can and has been applied to protocols over fiber and RF as well. Formulate a plan for investigation The best start is often not mentioned, but is quite important in practice. ...


1

I'm not sure it's a checksum either. FF may be used as a padding flag. Also I think your "record size" needs to be reevaluated. I see this as a series of bytes that start with 10 02 xx yy yy zz zz x and y might be options z looks like data or a sequence (ish) Then the next record looks like this 10 03 xx xx Here's an observation on the 10 03 records: 10 ...


1

You have captured the bluetooth RFCOMM frames. These include various control fields which are handled by the bluetooth stack and are transparent to the overlying application layer. (Think serial port like communication with start/stop/parity bits being added but just over bluetooth instead.) In your frames: The 1st byte 0B is the address field. The 2nd ...


1

Because you have 3 of 5 messages absolutely identical, and because the other two differ very little, it seems probable that the first two messages were simply captured incorrectly. The way to try to detect that would be to do the same thing several more times to see if that pattern holds. More generally, reverse engineering a protocol like this often ...


1

Looking at the website for the software vendor, it recommends that the DVR on the other end of the connection be set to "Substream, CIF or QCIF at 6-10 FPS". Those refer to the "Common Intermediate Format" and "Quarter Common Intermediate Format" respectively. They are defined within the "H.261 Video codec for audiovisual services at p x 64 kbit/s" ...


Only top voted, non community-wiki answers of a minimum length are eligible