View Full Version : Find symbols from statically linked library
rajkosto
July 5th, 2009, 07:01
I have an application that uses the Crypto++ library for all its crypto. I am trying to figure out the network protocol of this application, however this is very hard as Crypto++ is heavily templated and in addition, in this exe, its statically linked. Since Crypto++ is open source, is there any way i could compile it myself, and import the symbols into the exe so that i could see when Crypto++ functions are being called ? This is further complicated by the fact that i would have to compile the exact version they used to make the exe, however i have no idea what they used, but it seems to be an older version (4.x). So my questions would be
1. How do i effectively find out version of crypto++ used
2. How do i import library symbols into IDA pro, so that i can see when they are being called in the exe ?
disavowed
July 5th, 2009, 09:16
1. Non-trivial. You could look at a string dump for clues (sometimes certain strings are added and removed between versions). Other people on this board will probably have other suggestions as well.
2. You can start with http://www.woodmann.com/collaborative/tools/Category:IDA_Signature_Creation_Tools
rajkosto
July 5th, 2009, 09:19
well, there is one very obvious function which calls a windows function, its in osrng.h, the random number generator
it calls cryptgenrandom, but whatever version if crypto++ i compile, the flow is different than the one in the exe... not similar at all
disavowed
July 5th, 2009, 12:15
Different compilers?
rajkosto
July 5th, 2009, 12:16
used the same one, msvc7.1
maybe something was stripped when it was included in exe ?
arc_
July 6th, 2009, 11:53
You'd be *very* lucky to generate the exact same binary by compiling from source. Especially when lots of optimizations are enabled, things get very unpredictable and could in fact depend on the rest of the program. For example, small crypto++ functions could have been inlined, others could have been changed so their parameters are passed through registers instead of the stack, etc.
I would say compiling from source to obtain something usable for signature scanning is damn near impossible.
rajkosto
July 6th, 2009, 12:00
cryptopp was first compiled as a static library (.lib)
then linked in with this program...
i know that it uses templates and some inline functions, and i wont be able to detect those by signatures
but the ones which were used from the .lib linked, i should be able to recognize them
Powered by vBulletin® Version 4.2.2 Copyright © 2018 vBulletin Solutions, Inc. All rights reserved.