Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add alternative magic constant for XTEA #4

Closed
pawlos opened this issue Feb 10, 2020 · 1 comment
Closed

Add alternative magic constant for XTEA #4

pawlos opened this issue Feb 10, 2020 · 1 comment

Comments

@pawlos
Copy link
Contributor

pawlos commented Feb 10, 2020

Thx for this great extension.

I've tried to test it on one of the binaries which contains XTEA crypto and was surprised to get no results. I've reversed the database and noticed that the constant for TEA_DELTA is 0x9E3779B9. But this challenge was using an alternative value which is 0x61C88647 and instead of adding it, subtracts.

More about this here: https://crypto.stackexchange.com/a/12570/41535

It would be nice to detect that too.

Tried to find if there's any tool to extend the DB sot that I could send a PR. Is the FCExporter I should use to generate the new DB? Is so I'll try to compile and send a PR if it's ok to add this additional constant for XTEA.

FYI the challenge was MugatuWare from Flare-On 2019 (it was in the dll, not initial exe).

@d3v1l401
Copy link
Owner

Your pull request has been approved.
The tool will not detect the algorithm itself as it may, as you also noticed, be modified.
We target the constants being used, reason why I accepted your pull request and I noticed that you figured out by yourself how to integrate new signatures in the database :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants