current community

your communities

more stack exchange communities

Stack Exchange
tour help
Take the 2-minute tour ×
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It's 100% free, no registration required.
up vote 18 down vote favorite
6

I'm analyzing some software that appears to encrypt its communications over the network, but it does not appear to be SSL. How can I easily determine what encryption algorithm its using, and maybe find the key?

share|improve this question
    
Just to make it clear. Do you want to identify the encryption algorithm based on the assembly code of the encryption algorithm or based only on the encrypted packets ? –  perror Apr 2 '13 at 17:00
    
@perror I have access to the binaries and its resulting network traffic. So which ever is easier. Using the IDA plugins suggested fixed my immediate problem, but is there an easier way, for future reference, to do it based solely on network traffic? I would have assumed that since the traffic had no header or identifiable information that it would not be possible. –  omghai2u Apr 2 '13 at 17:09

4 Answers 4

up vote 14 down vote accepted

Maybe check out this IDA plugin.

After you locate the crypto functions, doing a cross-reference in IDA should allow you to see where the functions are called and likely the key is nearby. If you can set a break-point on those functions and see what is being passed in for the key, this, of course, would be the easiest way.

share|improve this answer
3  
I this there is an updated version, FindCrypt2 hexblog.com/?p=28 –  0xea Mar 31 '13 at 10:20
up vote 9 down vote

For a bit more advanced way of automatic crypto identification see Felix Gröbert's work on Automatic Identification of Cryptographic Primitives in Software . He uses a pintool to dynamically instrument the code which can allow to even recover keys. The code is also available. The repository contains other tools used in comparison , such as PeID and OllyDBG plugins.

share|improve this answer
up vote 7 down vote

I have not used it but there is an open source tool called Aligot that may help when the encryption algorithms have been obfuscated. According to its authors, Aligot can idenfity TEA, MD5, RC4 and AES.

Aligot does have an important disclaimer:

Aligot was build as a proof-of-concept to illustrate the principles described in the associated paper. In particular it is not currently suitable to automatically analyze large programs. If you are interested in such project, please contact the author ;)

Despite the disclaimer, the results indicated in the paper suggest that Aligot is worth looking into.

share|improve this answer
up vote 5 down vote

A nice combination of findcrypt2 by HexRays and the work done by Felix Gröbert is IDAScope. It's very useful for searching for and identifying encryption algorithms. For more information on IDAScope's Crypto Identification I'd recommend the following link.

share|improve this answer
    
How does it improve on findcrypt2 and HexRays? What makes it better, faster, etc.? –  Lizz Apr 6 '13 at 4:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.