Intro to reverse engineering

sudo apt-get install ghidra

• hexdump hd filename | head
  • First bit are the magic number identifiying the filetype
  • deassembler → machine to assembly code

Rev eng decrypting functions

• Open Ghidra and create a new project

• Then import the shared object we want to reverse engineer to find the decryption key

• Use the search tool to find what you’re looking for

• And try to first find some human readable error message or text to figure out if you're at the right place or not mdr

  

• Since it is DES encrypted, then we’re looking for a 64 bits long key an look we have a memcopy to a 8 bytes long array, if we look at the copied value it is probably the decryption key

• Note, we can rename the variables and types by right clicking on variables or types

Decrypting configuration files

openssl enc -d -des-ecb -K 478DA50FF9E3D2CB -in default_config.xml -nopad

• enc the encryption method
• -d to use it in decryption mode
• -des-ecb since we know the file is DES encrypted, may requires few algorithm trials to find the right one
• -in the input file to decrypt