Can't decrypt these strings

Question

Preamble

I'm trying to disassemble and reverse-engineer a program whose author is long gone. The program provides some unique features that I have yet to find elsewhere and... I'm curious and intrigued by reverse-engineering the program. If you're just gonna try and help me find another program... don't bother.

The Problem

I'm using IDA Pro w/ Hex-Rays Decompiler to get some half-way decent pseudocode to try and speed up the reverse-engineering. One big thing that I think will help speed up things is to figure out what strings mean. So far, this is what I'm finding for strings that are more than 4 characters longer:

dword_131894E = 54264588;
dword_131894A = 51381002;
dword_1318946 = 51380998;
dword_1318942 = 52429571;
dword_131893E = 52298503;
runtimeVersion[0] = 836;
szIndex = 0;
do
{
  runtimeVersion[szIndex] = (runtimeVersion[szIndex] - 1) ^ (szIndex + 882) ^ 0x47;
  ++szIndex;
}
while ( szIndex < 11 );

From looking at similar pseudocode for strings that are three characters, and using the Hex-Rays hover overs for type information, here's how I'm understanding this:

• runtimeVersion is a const wchar
• this means it has Unicode characters (UTF-16)
• the string is embedded in memory, but in this case, weakly encrypted (XOR?)

The above pseudocode is the same for all the big strings except the constant "882" is different for every string. I'm assuming this is some sort compile-time encryption or macro that finds strings one by one and "encrypts" them uniquely. The problem is, though, that I can't seem to get a proper looking string by replicating the pseudocode. Here's what I have in C#:

ushort[] newCharArray = new ushort[rawCharacters.Length];

// Go through and decode all of the characters.
ushort i = 0;
do {
    newCharArray[i] = (ushort)((i + 882) ^ (rawCharacters[i] - 1) ^ 0x47);
    ++i;
}
while (i < 11);

'rawCharacters' is a ushort array. I split each of those dword entries in half and treat each one as a ushort. I put them in the array starting from the bottom to the top... So the value assigned to runtimeVersion[0] gets added to my array first, then the value from dword_131893E, then dword_1318942, etc.

I'm not sure what I'm missing here. This seems like it's so simple that it should be cake to reverse and recover the strings, but I'm getting stumped on the conversion from the pseudocode to actual code.

Thoughts?

Kathrinkathrine

its not at all related to '''decryption'''. You might mean decoding not decrypting. – Obrian

Call it whatever you want. It's readily apparent that big strings are transformed from their original form into something that is intended to make them harder to pull out of the executable. To me, that's encryption... but maybe to you SSL is just an "encoding" :P – Kathrinkathrine

Have you tried different variations, like xoring it differently or using a different encoding (utf8, utf16, etc.) ? – Ceballos

My first guess is that you are loading rawCharacters incorrectly. Can you include the source that shows the loading of the data in your C# and the Hex-Rays output of the declaration of RuntimeVersion? – Allman

Are you sure the code you found is encrypting? My thought is that the string is stored encrypted in the executable image, and the software unwinds it back into something intelligible. – Bregma

I read the preamble and just knew that security cracking was going to be in there somewhere. Also 'If you're just gonna try and help me find another program... don't bother' - smells a little 'off' :(( I'm curious and intrigued by wondering which app you are asking us to help with hacking? – Kele

@TobyLawrence How is dword_131894E and other similar variables related to the problem? Does runtimeVersion gets initialized from these? – Oilstone

@MartinJames A tool for doing OBD-II communication with, primarily, Volkswagen ME7.5 ECUs. Most scan tools expect you to have cables that implement helper ICs that handle the low-level timings, etc, but this program does all of that itself. I'm interested in it because I want to recreate the low-level stuff in an embedded project. – Kathrinkathrine

@Oilstone The psuedocode isn't very obvious, but if you double-click the named variables, they are right above the "dwords" in the data. So, for example, "runtimeVersionSz" is located at .data:131893A and then dword_131893E comes right after it... it's the decompilers odd way of representing these encrypted constant strings, as far as I can tell. – Kathrinkathrine

Answer 1

Ok working through on a piece of paper here's what i get:

54264588 = 0x033c030c
51381002 = 0x0310030a
51380998 = 0x03100306
52429571 = 0x03200303
52298503 = 0x031E0307
836 = 0x0344
882 = 0x0372

v = 0x0076 = 0x47 ^ 0x0372 ^ (0x0344 - 1)
2 = 0x0032 = 0x47 ^ 0x0373 ^ (0x0307 - 1)
. = 0x002E = 0x47 ^ 0x0374 ^ (0x031E - 1)
0 = 0x0030 = 0x47 ^ 0x0375 ^ (0x0303 - 1)
. = 0x0076 = 0x47 ^ 0x0376 ^ (0x0320 - 1)
5 = 0x0035 = 0x47 ^ 0x0377 ^ (0x0306 - 1)
0 = 0x0030 = 0x47 ^ 0x0378 ^ (0x0310 - 1)
7 = 0x0037 = 0x47 ^ 0x0379 ^ (0x030a - 1)
2 = 0x0032 = 0x47 ^ 0x037a ^ (0x0310 - 1)
7 = 0x0037 = 0x47 ^ 0x037b ^ (0x030c - 1)
\0 = 0x0000 = 0x47 ^ 0x037c ^ (0x033c - 1)

Therefore the string is "v2.0.50727" I also checked the other endian option but this one looks much better. So i know this doesn't point out where your code is wrong but it should help you solve it with a debugger/printf.

Edit: added last 7 to string.

Clem

I think you missed the last "7" on the string, which would make it "v2.0.50727" - the current .NET 2 version number. – Onionskin

I just replicated your math spot on. Let me go back through my code and figure out where I messed up. – Kathrinkathrine

So the problem was how I was interpreting the order of the bytes in the dwords. In the example I gave, I was reading the data as: 0x344, 0x31e, 0x307, 0x320, etc. It looks like your order (two bytes on the right of each dword first, then two first bytes) is what did the trick. Thanks for helping me figure this out. It was getting so damn frustrating. :) Also, sorry to everyone else who looked at the question and didn't have enough information from one on precisely what I was doing to render an appropriate answer. – Kathrinkathrine