What is encryption? [PACKET]

[thourgh]

It is a packet which I removed with a game called packetlogger BoomBang .. I do not know what else to say but if you have a question Tell her in comments

Sorry for my bad English, I'm Spanish

 

[AngraMainyu]

Not sure why cryptography seems to be blowing everyone's minds lately, but we don't know the cipher and we don't have the key or plaintext so there's nothing anyone can do to help you without cracking open that particular game in a debugger.

 

[opCode]

You have to debug the what you have (client I think) and look in it on how this packet is assembled...
It's hard to do it, but i don't any other way.

If you have another i'd be happy to know!

 

[Razer]

Not sure if it'd be appropriate for this type of encryption, but there's the option of Bruteforce.
Try Hashcat, not sure if it's compatible with this sort, however.

 

[ThuGie]

Will give you basic info on how about getting this information you want.
First get yourself a flash decompiler. any should do..

Download this file static2.boombang.tv/flash_eng/BoomBangLoader.swf?1310999434
Decompile it you will notice as the name says its just a loader for the main file.
http://static2.boombang.tv/flash_eng/BoomBangKids.swf?v=
Download that decompile it, first think you might notice is that most strings are unreadable.

You will see it calls a function in my case its this one

package {

    public function irrcrpt(_arg1:String, _arg2:int):String{
        var _local5:int;
        var _local3:String = new String();
        var _local4:int;
        while (_local4 < _arg1.length) {
            _local5 = _arg1.charCodeAt(_local4);
            if ((((_local5 >= 48)) && ((_local5 <= 57)))){
                _local5 = ((_local5 - _arg2) - 48);
                if (_local5 < 0){
                    _local5 = (_local5 + ((57 - 48) + 1));
                };
                _local5 = ((_local5 % ((57 - 48) + 1)) + 48);
            } else {
                if ((((_local5 >= 65)) && ((_local5 <= 90)))){
                    _local5 = ((_local5 - _arg2) - 65);
                    if (_local5 < 0){
                        _local5 = (_local5 + ((90 - 65) + 1));
                    };
                    _local5 = ((_local5 % ((90 - 65) + 1)) + 65);
                } else {
                    if ((((_local5 >= 97)) && ((_local5 <= 122)))){
                        _local5 = ((_local5 - _arg2) - 97);
                        if (_local5 < 0){
                            _local5 = (_local5 + ((122 - 97) + 1));
                        };
                        _local5 = ((_local5 % ((122 - 97) + 1)) + 97);
                    };
                };
            };
            _local3 = (_local3 + String.fromCharCode(_local5));
            _local4++;
        };
        return (_local3);
    }
}//package

Not all that hard to write a app that does the same for this,
I asume since your asking about this encryption deal you at least know how to code.

Now you can make the strings readable.
But.. you might notice a lot of actionscript classes there names are a mess.
Try running it tru the app you created to see if same typ has been used.
Or try a decompiler that might support fixing that up.

If not well just work with what you got all flash functions should still have there own names so.

So just look for send/retrieve functions see whats calling them and what function is called inbetween aka encryption/decryption.
Why you need the code to be able to read strings, as if its using a key the key is probably in the same mess as any other string.

Good luck!

Small hint:
src/utils/boombang/crypto < might have the key etc .
src/utils/boombang/crypto/hurlant/crypto/ < more info about the crypto

Encryption: AES, Mode: ECB, Padding: PKCS5

 

[thourgh]

Son la hostia, enserio. Pueden cerrar el post XD

 

[ThuGie]

At least try to write your post in english, even if its not 100% clear.

 

[lozirlo]

At least try to write your post in english, even if its not 100% clear.

http://forum.ragezone.com/f144/decrypt-packets-911921/

 

[thourgh]

You can close the post, and I see that I can not xd