![]() |
|
#1
|
|||
|
|||
|
Any pointers on this troublesome algorithm?
For a few weeks now, I've been trying to figure out a cryptography problem that I just couldn't wrap my mind around, and I think I might need guidance and/or recommendations on where to learn more about the math/logic behind it.
I've got an program whose decryption method I want to reverse engineer; I know the exact decryption routine and subroutines, I know the encryption key(s) used in the process, and I've already analyzed it and created a fully working PoC decrypter whose input is legitimate license file data and whose output is the decrypted license data in a hex dump-like format (only 64 bytes). I have multiple license files (which they allow)—all of which are radically different in terms of original encrypted data, but whose decrypted data is all the exact same except for one single 4-byte value, which is seemingly random and pre-determined upon license file generation. In other words, every license file decrypts to the same exact values each time, but that one DWORD in the decrypted data is different across the different license files; the other remaining 60 bytes are exactly the same across all of the files. To exemplify this, I've noted the data of 3 legitimate license files below: Code:
f595c42c 856dba93 c4c0d727 ffd57d2b 856ed27b b9cc5541 8f0319ce 5ba13412 31fbd174 63e16ce8 f09f8ce7 198db818 c74906ce 95bbaf74 dd94c717 60b43434 38c9b73b 1f480921 a2b4c9e8 2b29aed2 123914a2 abde2de8 4755fe59 19054298 4be819bc 6bdd26a9 33f993da 28c6d1f6 03484b72 56366f7d 37d36a4c 8c9d7c72 bca7ea45 9caa59b6 b0ed8a69 c46dc7a7 daddc9be 7eb9ac5a bc52d5ac ae60e5b1 c3d8e996 64596547 6f72317f 927b9b4c ecc35ec0 c38f569f 2a134665 13b80770 6be8d4c1 ee0f273d 30953dcb f87254dd 78d9dbbb 25c279a4 43b59bf9 44b51c8b aab2e8f0 bdb13c03 afa0b98a 2c5c2c67 930d251e 09b5efed 0a9417bf 4d650961 2e505aed 22ffb2f4 a9c6767a 69a5e2b9 566e4415 f70a0d01 f38a4b66 cae31d07 22971759 8a8ea209 2b5f5a0f 8d1b7247 01d11a7d c7fb87a3 712f4cc1 0d0b99ba 95079986 387d677d 1f8d4334 f3d7f586 50bc363d b5cc9fa7 6dbb58e5 b5637206 5112fd20 1d784619 4bbedde5 a7efbb67 7a2d1078 2b321fee 7b077516 953030e3 Code:
00000001 13a303bf 04010503 02070609 140f760b 00000001 02a00bd1 00000001 ffffff00 ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff 0001ffff 00000001 13a303bf 04010503 02070609 1c42bafb 00000001 02a00bd1 00000001 ffffff00 ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff 0001ffff 00000001 13a303bf 04010503 02070609 4207e5e1 00000001 02a00bd1 00000001 ffffff00 ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff 0001ffff With my current level of knowledge, I'm not sure how this would be able to be reversed, since one of the first steps would involve knowledge of the final output, which would be seemingly impossible. =/ At this stage, I need help reversing the process. I only want to create a PoC encrypter; I don't want to patch the program or otherwise bypass the mechanism. Is there anywhere I can go from here? It's verbosely commented and kind of messy-ish, but you can find the source code for my PoC decrypter here: Code:
https://mega.nz/#!Z4F2nIbC!jMVjh0jxz5jBU6SpvAicSaydPkx9S-jyEbGoMfJVL88 NOTE: I decided to post in General Discussion because of the educational opportunities I'm hoping to gain from this (so I can start contributing more), but feel free to delete this thread if it's too request-y for this section. ^^; |
| The Following User Says Thank You to Cryo For This Useful Post: | ||
dila (10-20-2016) | ||
| Thread Tools | |
| Display Modes | |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Pointers in Delphi | chessgod101 | Source Code | 1 | 04-06-2014 23:54 |
| Need some pointers with a .Net target | Sailor_EDA | General Discussion | 10 | 03-03-2010 12:18 |
| x64 Website Pointers | Evilcry | x64 OS | 3 | 10-01-2009 22:25 |
| Need some pointers | lorn | General Discussion | 8 | 11-04-2004 13:20 |