warrenarea
commented
7 years ago okay, an even BETTER find. Here is the function for the Epoc+ crypt keys and their variants.
As a recap, here is the one we found the other day...
k = ['\0'] * 16
k[0] = serial_number[-1]
k[1] = '\x00'
k[2] = serial_number[-2]
k[3] = '\x15'
k[4] = serial_number[-3]
k[5] = '\x00'
k[6] = serial_number[-4]
k[7] = '\x0C'
k[8] = serial_number[-3]
k[9] = '\x00'
k[10] = serial_number[-2]
k[11] = 'D'
k[12] = serial_number[-1]
k[13] = '\x00'
k[14] = serial_number[-2]
k[15] = 'X'Now compare it to the code here:
where D=68 X=88 and 12 = 0xC and v9/byte1/byte2/byte3 = SN
char __thiscall sub_1290AC0(int this)
{
int v1; // edi@1
char *v2; // ecx@1
char *v3; // eax@3
_BYTE *v4; // ecx@3
_BYTE *v5; // ecx@5
char v6; // ST20_1@7
int v8; // [sp+Ch] [bp-4Ch]@1
int v9; // [sp+10h] [bp-48h]@7
void *v10; // [sp+18h] [bp-40h]@1
int v11; // [sp+28h] [bp-30h]@3
unsigned int v12; // [sp+2Ch] [bp-2Ch]@1
void *v13; // [sp+30h] [bp-28h]@3
int v14; // [sp+40h] [bp-18h]@3
unsigned int v15; // [sp+44h] [bp-14h]@3
int v16; // [sp+54h] [bp-4h]@3
v8 = this;
v1 = this + 158;
_mm_storeu_si128((this + 158), 0i64);
(*(*this + 48))(&v10);
v2 = &v10;
if ( v12 >= 8 )
{
v2 = v10;
}
v16 = 0;
v15 = 15;
v3 = &v2[2 * v11];
v14 = 0;
v4 = &v10;
LOBYTE(v13) = 0;
if ( v12 >= 8 )
{
v4 = v10;
}
sub_11910C0(&v13, v4, v3, v8);
v5 = &v13;
if ( v15 >= 0x10 )
{
v5 = v13;
}
LOBYTE(v16) = 1;
v9 = *v5;
v6 = v5[4];
if ( (*(*v8 + 76))(v8) == 2 )
{
if ( *(v8 + 148) & 0xF00 )
{
*(v8 + 4) = 2;
}
else
{
*(v8 + 4) = 3;
}
}
else if ( *(v8 + 148) & 0xF00 )
{
*(v8 + 4) = 1;
}
else
{
*(v8 + 4) = 0;
}
switch ( *(v8 + 4) )
{
case 0:
*v1 = BYTE1(v9);
*(v1 + 1) = 0;
*(v1 + 2) = v9;
*(v1 + 3) = 68;
*(v1 + 4) = BYTE1(v9);
*(v1 + 5) = 0;
*(v1 + 6) = v9;
*(v1 + 7) = 12;
*(v1 + 8) = BYTE3(v9);
*(v1 + 9) = 0;
*(v1 + 10) = BYTE2(v9);
*(v1 + 11) = 21;
*(v1 + 12) = BYTE3(v9);
*(v1 + 13) = 0;
*(v1 + 14) = BYTE2(v9);
*(v1 + 15) = 88;
break;
case 1:
*v1 = v9;
*(v1 + 1) = 0;
*(v1 + 2) = BYTE1(v9);
*(v1 + 3) = 21;
*(v1 + 4) = BYTE2(v9);
*(v1 + 5) = 0;
*(v1 + 6) = BYTE3(v9);
*(v1 + 7) = 12;
*(v1 + 8) = BYTE2(v9);
*(v1 + 9) = 0;
*(v1 + 10) = BYTE1(v9);
*(v1 + 11) = 68;
*(v1 + 12) = v9;
*(v1 + 13) = 0;
*(v1 + 14) = BYTE1(v9);
*(v1 + 15) = 88;
break;
case 3:
*v1 = BYTE1(v9);
*(v1 + 1) = v9;
*(v1 + 2) = BYTE1(v9);
*(v1 + 3) = v9;
*(v1 + 4) = BYTE2(v9);
*(v1 + 5) = BYTE3(v9);
*(v1 + 6) = BYTE2(v9);
*(v1 + 7) = BYTE3(v9);
*(v1 + 8) = BYTE3(v9);
*(v1 + 9) = BYTE2(v9);
*(v1 + 10) = BYTE3(v9);
*(v1 + 11) = BYTE2(v9);
*(v1 + 12) = v9;
*(v1 + 13) = BYTE1(v9);
*(v1 + 14) = v9;
*(v1 + 15) = BYTE1(v9);
break;
case 2:
*v1 = v9;
*(v1 + 1) = BYTE1(v9);
*(v1 + 2) = BYTE1(v9);
*(v1 + 3) = BYTE2(v9);
*(v1 + 4) = BYTE2(v9);
*(v1 + 5) = BYTE2(v9);
*(v1 + 6) = BYTE1(v9);
*(v1 + 7) = BYTE3(v9);
*(v1 + 8) = v9;
*(v1 + 9) = BYTE3(v9);
*(v1 + 10) = BYTE1(v9);
*(v1 + 11) = BYTE1(v9);
*(v1 + 12) = BYTE3(v9);
*(v1 + 13) = BYTE3(v9);
*(v1 + 14) = BYTE1(v9);
*(v1 + 15) = v9;
break;
default:
break;
}
if ( v15 >= 0x10 )
{
operator delete(v13);
}
if ( v12 >= 8 )
{
operator delete(v10);
}
return 1;
}
ron-weiner
ghost
CaptainSmileyXL
So it occurs to me that trying to locate the get_level and decryption functions, based on where the rjindael code is... is pretty much a lost cause, because the rjindael is just mixed in with a bunch of other encryption functions, and they could be doing all sorts of other processes in between actually utilizing the data acquired.
So I think I'm getting a little closer, by first looking at "Imports" or Symbols, which are basically the function names.
What I want to focus on at this point, is "sure thing" code and recognizable code segments, because there is a ton of code, and we don't want to waste our time on false positives and confusing ourselves.
I think I'll break the code up into sections, to make it easier to edit later.
If you want to comment on an item, reference its function name. (for clarity)