Page 1 of 1

Identifying crypto++ functions

Posted: Wed Aug 15, 2012 8:18 pm
by WRS
my research covers a lot of encrypted data structures and i often i am stuck when it comes to identifying the actual encryption methods :|

for a known compiler (vc++ 6.0), is it possible to create signatures for compiled functions to identify which ones are used?

else, general tips for identifying the algorithm functions? with so much data, i fallback on string references in my debugger and am not getting anywhere

8)

Re: Identifying crypto++ functions

Posted: Wed Aug 15, 2012 8:46 pm
by aluigi
crypto++ uses the common algorithms like the others so signsrch will get them.

the only problem is with those that don't use static tables and constants like rc4

Re: Identifying crypto++ functions

Posted: Wed Aug 15, 2012 10:43 pm
by WRS
i've tried my luck at bruteforcing with quicbms, and the rc4 is the only algorithm which accepts my key length(202 bytes)

i hate being utterly stuck for ideas :twisted:

Re: Identifying crypto++ functions

Posted: Thu Aug 16, 2012 2:58 pm
by aluigi
are you sure it's not a proprietary algorithm or an hash one applied over that 202 bytes key for generating one suitable for a block cipher algorithm?
(like md5 of that key to have a 16bytes key)

Re: Identifying crypto++ functions

Posted: Thu Aug 16, 2012 4:11 pm
by mambox
@Aluigi:i thought you were on vacation, I have not read new posts on your site.

i dont want to pollute the thread,greets.