Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.
009327A0   /$  53                PUSH EBX
009327A1   |.  55                PUSH EBP
009327A2   |.  56                PUSH ESI
009327A3   |.  8BF0              MOV ESI,EAX
009327A5   |.  8B56 04           MOV EDX,DWORD PTR DS:[ESI+4]
009327A8   |.  8B4424 10         MOV EAX,DWORD PTR SS:[ESP+10]                                                       ;  yo3.009331A3
009327AC   |.  57                PUSH EDI
009327AD   |.  8B3E              MOV EDI,DWORD PTR DS:[ESI]
009327AF   |.  8B4F 44           MOV ECX,DWORD PTR DS:[EDI+44]
009327B2   |.  3308              XOR ECX,DWORD PTR DS:[EAX]
009327B4   |.  8BC1              MOV EAX,ECX
009327B6   |.  C1E8 10           SHR EAX,10
009327B9   |.  25 FF000000       AND EAX,0FF
009327BE   |.  8B8482 00040000   MOV EAX,DWORD PTR DS:[EDX+EAX*4+400]
009327C5   |.  8BD9              MOV EBX,ECX
009327C7   |.  C1EB 18           SHR EBX,18
009327CA   |.  03049A            ADD EAX,DWORD PTR DS:[EDX+EBX*4]
009327CD   |.  8BD9              MOV EBX,ECX
009327CF   |.  C1EB 08           SHR EBX,8
009327D2   |.  81E3 FF000000     AND EBX,0FF
009327D8   |.  33849A 00080000   XOR EAX,DWORD PTR DS:[EDX+EBX*4+800]
009327DF   |.  8BD9              MOV EBX,ECX
009327E1   |.  81E3 FF000000     AND EBX,0FF
009327E7   |.  03849A 000C0000   ADD EAX,DWORD PTR DS:[EDX+EBX*4+C00]
009327EE   |.  8B5C24 18         MOV EBX,DWORD PTR SS:[ESP+18]
009327F2   |.  3347 40           XOR EAX,DWORD PTR DS:[EDI+40]
009327F5   |.  3303              XOR EAX,DWORD PTR DS:[EBX]
009327F7   |.  8BD8              MOV EBX,EAX
009327F9   |.  C1EB 10           SHR EBX,10
009327FC   |.  81E3 FF000000     AND EBX,0FF
00932802   |.  8B9C9A 00040000   MOV EBX,DWORD PTR DS:[EDX+EBX*4+400]
00932809   |.  8BE8              MOV EBP,EAX
0093280B   |.  C1ED 18           SHR EBP,18
0093280E   |.  031CAA            ADD EBX,DWORD PTR DS:[EDX+EBP*4]
00932811   |.  8BE8              MOV EBP,EAX
00932813   |.  C1ED 08           SHR EBP,8
00932816   |.  81E5 FF000000     AND EBP,0FF
0093281C   |.  339CAA 00080000   XOR EBX,DWORD PTR DS:[EDX+EBP*4+800]
00932823   |.  8BE8              MOV EBP,EAX
00932825   |.  81E5 FF000000     AND EBP,0FF
0093282B   |.  039CAA 000C0000   ADD EBX,DWORD PTR DS:[EDX+EBP*4+C00]
00932832   |.  335F 3C           XOR EBX,DWORD PTR DS:[EDI+3C]
00932835   |.  33CB              XOR ECX,EBX
00932837   |.  8BD9              MOV EBX,ECX
00932839   |.  C1EB 10           SHR EBX,10
0093283C   |.  81E3 FF000000     AND EBX,0FF
00932842   |.  8B9C9A 00040000   MOV EBX,DWORD PTR DS:[EDX+EBX*4+400]
00932849   |.  8BE9              MOV EBP,ECX
0093284B   |.  C1ED 18           SHR EBP,18
0093284E   |.  031CAA            ADD EBX,DWORD PTR DS:[EDX+EBP*4]
00932851   |.  8BE9              MOV EBP,ECX
00932853   |.  C1ED 08           SHR EBP,8
00932856   |.  81E5 FF000000     AND EBP,0FF
0093285C   |.  339CAA 00080000   XOR EBX,DWORD PTR DS:[EDX+EBP*4+800]
00932863   |.  8BE9              MOV EBP,ECX
00932865   |.  81E5 FF000000     AND EBP,0FF
0093286B   |.  039CAA 000C0000   ADD EBX,DWORD PTR DS:[EDX+EBP*4+C00]
00932872   |.  335F 38           XOR EBX,DWORD PTR DS:[EDI+38]
00932875   |.  33C3              XOR EAX,EBX
00932877   |.  8BD8              MOV EBX,EAX
00932879   |.  C1EB 10           SHR EBX,10
0093287C   |.  81E3 FF000000     AND EBX,0FF
00932882   |.  8B9C9A 00040000   MOV EBX,DWORD PTR DS:[EDX+EBX*4+400]
00932889   |.  8BE8              MOV EBP,EAX
0093288B   |.  C1ED 18           SHR EBP,18
0093288E   |.  031CAA            ADD EBX,DWORD PTR DS:[EDX+EBP*4]
00932891   |.  8BE8              MOV EBP,EAX
00932893   |.  C1ED 08           SHR EBP,8
00932896   |.  81E5 FF000000     AND EBP,0FF
0093289C   |.  339CAA 00080000   XOR EBX,DWORD PTR DS:[EDX+EBP*4+800]
009328A3   |.  8BE8              MOV EBP,EAX
009328A5   |.  81E5 FF000000     AND EBP,0FF
009328AB   |.  039CAA 000C0000   ADD EBX,DWORD PTR DS:[EDX+EBP*4+C00]
009328B2   |.  335F 34           XOR EBX,DWORD PTR DS:[EDI+34]
009328B5   |.  33CB              XOR ECX,EBX
009328B7   |.  8BD9              MOV EBX,ECX
009328B9   |.  C1EB 10           SHR EBX,10
009328BC   |.  81E3 FF000000     AND EBX,0FF
009328C2   |.  8B9C9A 00040000   MOV EBX,DWORD PTR DS:[EDX+EBX*4+400]
009328C9   |.  8BE9              MOV EBP,ECX
009328CB   |.  C1ED 18           SHR EBP,18
009328CE   |.  031CAA            ADD EBX,DWORD PTR DS:[EDX+EBP*4]
009328D1   |.  8BE9              MOV EBP,ECX
009328D3   |.  C1ED 08           SHR EBP,8
009328D6   |.  81E5 FF000000     AND EBP,0FF
009328DC   |.  339CAA 00080000   XOR EBX,DWORD PTR DS:[EDX+EBP*4+800]
009328E3   |.  8BE9              MOV EBP,ECX
009328E5   |.  81E5 FF000000     AND EBP,0FF
009328EB   |.  039CAA 000C0000   ADD EBX,DWORD PTR DS:[EDX+EBP*4+C00]
009328F2   |.  8BF2              MOV ESI,EDX
009328F4   |.  335F 30           XOR EBX,DWORD PTR DS:[EDI+30]
009328F7   |.  33C3              XOR EAX,EBX
009328F9   |.  8BD8              MOV EBX,EAX
009328FB   |.  C1EB 10           SHR EBX,10
009328FE   |.  81E3 FF000000     AND EBX,0FF
00932904   |.  8B9C9A 00040000   MOV EBX,DWORD PTR DS:[EDX+EBX*4+400]
0093290B   |.  8BE8              MOV EBP,EAX
0093290D   |.  C1ED 18           SHR EBP,18
00932910   |.  031CAA            ADD EBX,DWORD PTR DS:[EDX+EBP*4]
00932913   |.  8BE8              MOV EBP,EAX
00932915   |.  C1ED 08           SHR EBP,8
00932918   |.  81E5 FF000000     AND EBP,0FF
0093291E   |.  339CAA 00080000   XOR EBX,DWORD PTR DS:[EDX+EBP*4+800]
00932925   |.  8BE8              MOV EBP,EAX
00932927   |.  81E5 FF000000     AND EBP,0FF
0093292D   |.  039CAA 000C0000   ADD EBX,DWORD PTR DS:[EDX+EBP*4+C00]
00932934   |.  335F 2C           XOR EBX,DWORD PTR DS:[EDI+2C]
00932937   |.  33CB              XOR ECX,EBX
00932939   |.  8BD9              MOV EBX,ECX
0093293B   |.  C1EB 10           SHR EBX,10
0093293E   |.  81E3 FF000000     AND EBX,0FF
00932944   |.  8B9C9A 00040000   MOV EBX,DWORD PTR DS:[EDX+EBX*4+400]
0093294B   |.  8BE9              MOV EBP,ECX
0093294D   |.  C1ED 18           SHR EBP,18
00932950   |.  031CAA            ADD EBX,DWORD PTR DS:[EDX+EBP*4]
00932953   |.  8BE9              MOV EBP,ECX
00932955   |.  C1ED 08           SHR EBP,8
00932958   |.  81E5 FF000000     AND EBP,0FF
0093295E   |.  339CAA 00080000   XOR EBX,DWORD PTR DS:[EDX+EBP*4+800]
00932965   |.  8BE9              MOV EBP,ECX
00932967   |.  81E5 FF000000     AND EBP,0FF
0093296D   |.  039CAA 000C0000   ADD EBX,DWORD PTR DS:[EDX+EBP*4+C00]
00932974   |.  335F 28           XOR EBX,DWORD PTR DS:[EDI+28]
00932977   |.  33C3              XOR EAX,EBX
00932979   |.  8BD8              MOV EBX,EAX
0093297B   |.  C1EB 10           SHR EBX,10
0093297E   |.  81E3 FF000000     AND EBX,0FF
00932984   |.  8B9C9A 00040000   MOV EBX,DWORD PTR DS:[EDX+EBX*4+400]
0093298B   |.  8BE8              MOV EBP,EAX
0093298D   |.  C1ED 18           SHR EBP,18
00932990   |.  031CAA            ADD EBX,DWORD PTR DS:[EDX+EBP*4]
00932993   |.  8BE8              MOV EBP,EAX
00932995   |.  C1ED 08           SHR EBP,8
00932998   |.  81E5 FF000000     AND EBP,0FF
0093299E   |.  339CAA 00080000   XOR EBX,DWORD PTR DS:[EDX+EBP*4+800]
009329A5   |.  8BE8              MOV EBP,EAX
009329A7   |.  81E5 FF000000     AND EBP,0FF
009329AD   |.  039CAA 000C0000   ADD EBX,DWORD PTR DS:[EDX+EBP*4+C00]
009329B4   |.  335F 24           XOR EBX,DWORD PTR DS:[EDI+24]
009329B7   |.  33CB              XOR ECX,EBX
009329B9   |.  8BD9              MOV EBX,ECX
009329BB   |.  C1EB 10           SHR EBX,10
009329BE   |.  81E3 FF000000     AND EBX,0FF
009329C4   |.  8B9C9A 00040000   MOV EBX,DWORD PTR DS:[EDX+EBX*4+400]
009329CB   |.  8BE9              MOV EBP,ECX
009329CD   |.  C1ED 18           SHR EBP,18
009329D0   |.  031CAA            ADD EBX,DWORD PTR DS:[EDX+EBP*4]
009329D3   |.  8BD1              MOV EDX,ECX
009329D5   |.  C1EA 08           SHR EDX,8
009329D8   |.  81E2 FF000000     AND EDX,0FF
009329DE   |.  339C96 00080000   XOR EBX,DWORD PTR DS:[ESI+EDX*4+800]
009329E5   |.  8BD1              MOV EDX,ECX
009329E7   |.  81E2 FF000000     AND EDX,0FF
009329ED   |.  039C96 000C0000   ADD EBX,DWORD PTR DS:[ESI+EDX*4+C00]
009329F4   |.  335F 20           XOR EBX,DWORD PTR DS:[EDI+20]
009329F7   |.  33C3              XOR EAX,EBX
009329F9   |.  8BD0              MOV EDX,EAX
009329FB   |.  C1EA 10           SHR EDX,10
009329FE   |.  81E2 FF000000     AND EDX,0FF
00932A04   |.  8B9496 00040000   MOV EDX,DWORD PTR DS:[ESI+EDX*4+400]
00932A0B   |.  8BD8              MOV EBX,EAX
00932A0D   |.  C1EB 18           SHR EBX,18
00932A10   |.  03149E            ADD EDX,DWORD PTR DS:[ESI+EBX*4]
00932A13   |.  8BD8              MOV EBX,EAX
00932A15   |.  C1EB 08           SHR EBX,8
00932A18   |.  81E3 FF000000     AND EBX,0FF
00932A1E   |.  33949E 00080000   XOR EDX,DWORD PTR DS:[ESI+EBX*4+800]
00932A25   |.  8BD8              MOV EBX,EAX
00932A27   |.  81E3 FF000000     AND EBX,0FF
00932A2D   |.  03949E 000C0000   ADD EDX,DWORD PTR DS:[ESI+EBX*4+C00]
00932A34   |.  3357 1C           XOR EDX,DWORD PTR DS:[EDI+1C]
00932A37   |.  33CA              XOR ECX,EDX
00932A39   |.  8BD1              MOV EDX,ECX
00932A3B   |.  C1EA 10           SHR EDX,10
00932A3E   |.  81E2 FF000000     AND EDX,0FF
00932A44   |.  8B9496 00040000   MOV EDX,DWORD PTR DS:[ESI+EDX*4+400]
00932A4B   |.  8BD9              MOV EBX,ECX
00932A4D   |.  C1EB 18           SHR EBX,18
00932A50   |.  03149E            ADD EDX,DWORD PTR DS:[ESI+EBX*4]
00932A53   |.  8BD9              MOV EBX,ECX
00932A55   |.  C1EB 08           SHR EBX,8
00932A58   |.  81E3 FF000000     AND EBX,0FF
00932A5E   |.  33949E 00080000   XOR EDX,DWORD PTR DS:[ESI+EBX*4+800]
00932A65   |.  8BD9              MOV EBX,ECX
00932A67   |.  81E3 FF000000     AND EBX,0FF
00932A6D   |.  03949E 000C0000   ADD EDX,DWORD PTR DS:[ESI+EBX*4+C00]
00932A74   |.  3357 18           XOR EDX,DWORD PTR DS:[EDI+18]
00932A77   |.  33C2              XOR EAX,EDX
00932A79   |.  8BD0              MOV EDX,EAX
00932A7B   |.  C1EA 10           SHR EDX,10
00932A7E   |.  81E2 FF000000     AND EDX,0FF
00932A84   |.  8B9496 00040000   MOV EDX,DWORD PTR DS:[ESI+EDX*4+400]
00932A8B   |.  8BD8              MOV EBX,EAX
00932A8D   |.  C1EB 18           SHR EBX,18
00932A90   |.  03149E            ADD EDX,DWORD PTR DS:[ESI+EBX*4]
00932A93   |.  8BD8              MOV EBX,EAX
00932A95   |.  C1EB 08           SHR EBX,8
00932A98   |.  81E3 FF000000     AND EBX,0FF
00932A9E   |.  33949E 00080000   XOR EDX,DWORD PTR DS:[ESI+EBX*4+800]
00932AA5   |.  8BD8              MOV EBX,EAX
00932AA7   |.  81E3 FF000000     AND EBX,0FF
00932AAD   |.  03949E 000C0000   ADD EDX,DWORD PTR DS:[ESI+EBX*4+C00]
00932AB4   |.  3357 14           XOR EDX,DWORD PTR DS:[EDI+14]
00932AB7   |.  33CA              XOR ECX,EDX
00932AB9   |.  8BD1              MOV EDX,ECX
00932ABB   |.  C1EA 10           SHR EDX,10
00932ABE   |.  81E2 FF000000     AND EDX,0FF
00932AC4   |.  8B9496 00040000   MOV EDX,DWORD PTR DS:[ESI+EDX*4+400]
00932ACB   |.  8BD9              MOV EBX,ECX
00932ACD   |.  C1EB 18           SHR EBX,18
00932AD0   |.  03149E            ADD EDX,DWORD PTR DS:[ESI+EBX*4]
00932AD3   |.  8BD9              MOV EBX,ECX
00932AD5   |.  C1EB 08           SHR EBX,8
00932AD8   |.  81E3 FF000000     AND EBX,0FF
00932ADE   |.  33949E 00080000   XOR EDX,DWORD PTR DS:[ESI+EBX*4+800]
00932AE5   |.  8BD9              MOV EBX,ECX
00932AE7   |.  81E3 FF000000     AND EBX,0FF
00932AED   |.  03949E 000C0000   ADD EDX,DWORD PTR DS:[ESI+EBX*4+C00]
00932AF4   |.  3357 10           XOR EDX,DWORD PTR DS:[EDI+10]
00932AF7   |.  33C2              XOR EAX,EDX
00932AF9   |.  8BD0              MOV EDX,EAX
00932AFB   |.  C1EA 10           SHR EDX,10
00932AFE   |.  81E2 FF000000     AND EDX,0FF
00932B04   |.  8B9496 00040000   MOV EDX,DWORD PTR DS:[ESI+EDX*4+400]
00932B0B   |.  8BD8              MOV EBX,EAX
00932B0D   |.  C1EB 18           SHR EBX,18
00932B10   |.  03149E            ADD EDX,DWORD PTR DS:[ESI+EBX*4]
00932B13   |.  8BD8              MOV EBX,EAX
00932B15   |.  C1EB 08           SHR EBX,8
00932B18   |.  81E3 FF000000     AND EBX,0FF
00932B1E   |.  33949E 00080000   XOR EDX,DWORD PTR DS:[ESI+EBX*4+800]
00932B25   |.  8BD8              MOV EBX,EAX
00932B27   |.  81E3 FF000000     AND EBX,0FF
00932B2D   |.  03949E 000C0000   ADD EDX,DWORD PTR DS:[ESI+EBX*4+C00]
00932B34   |.  3357 0C           XOR EDX,DWORD PTR DS:[EDI+C]
00932B37   |.  33CA              XOR ECX,EDX
00932B39   |.  8BD1              MOV EDX,ECX
00932B3B   |.  C1EA 10           SHR EDX,10
00932B3E   |.  81E2 FF000000     AND EDX,0FF
00932B44   |.  8B9496 00040000   MOV EDX,DWORD PTR DS:[ESI+EDX*4+400]
00932B4B   |.  8BD9              MOV EBX,ECX
00932B4D   |.  C1EB 18           SHR EBX,18
00932B50   |.  03149E            ADD EDX,DWORD PTR DS:[ESI+EBX*4]
00932B53   |.  8BD9              MOV EBX,ECX
00932B55   |.  C1EB 08           SHR EBX,8
00932B58   |.  81E3 FF000000     AND EBX,0FF
00932B5E   |.  33949E 00080000   XOR EDX,DWORD PTR DS:[ESI+EBX*4+800]
00932B65   |.  8BD9              MOV EBX,ECX
00932B67   |.  81E3 FF000000     AND EBX,0FF
00932B6D   |.  03949E 000C0000   ADD EDX,DWORD PTR DS:[ESI+EBX*4+C00]
00932B74   |.  3357 08           XOR EDX,DWORD PTR DS:[EDI+8]
00932B77   |.  33C2              XOR EAX,EDX
00932B79   |.  8BD0              MOV EDX,EAX
00932B7B   |.  C1EA 10           SHR EDX,10
00932B7E   |.  81E2 FF000000     AND EDX,0FF
00932B84   |.  8B9496 00040000   MOV EDX,DWORD PTR DS:[ESI+EDX*4+400]
00932B8B   |.  8BD8              MOV EBX,EAX
00932B8D   |.  C1EB 18           SHR EBX,18
00932B90   |.  03149E            ADD EDX,DWORD PTR DS:[ESI+EBX*4]
00932B93   |.  8BD8              MOV EBX,EAX
00932B95   |.  C1EB 08           SHR EBX,8
00932B98   |.  81E3 FF000000     AND EBX,0FF
00932B9E   |.  33949E 00080000   XOR EDX,DWORD PTR DS:[ESI+EBX*4+800]
00932BA5   |.  8BD8              MOV EBX,EAX
00932BA7   |.  81E3 FF000000     AND EBX,0FF
00932BAD   |.  03949E 000C0000   ADD EDX,DWORD PTR DS:[ESI+EBX*4+C00]
00932BB4   |.  3357 04           XOR EDX,DWORD PTR DS:[EDI+4]
00932BB7   |.  33CA              XOR ECX,EDX
00932BB9   |.  8B17              MOV EDX,DWORD PTR DS:[EDI]
00932BBB   |.  33D0              XOR EDX,EAX
00932BBD   |.  8B4424 14         MOV EAX,DWORD PTR SS:[ESP+14]
00932BC1   |.  5F                POP EDI                                                                             ;  14D70138
00932BC2   |.  5E                POP ESI                                                                             ;  14D70138
00932BC3   |.  8910              MOV DWORD PTR DS:[EAX],EDX
00932BC5   |.  8B5424 10         MOV EDX,DWORD PTR SS:[ESP+10]                                                       ;  yo3.009331A3
00932BC9   |.  5D                POP EBP                                                                             ;  14D70138
00932BCA   |.  890A              MOV DWORD PTR DS:[EDX],ECX
00932BCC   |.  5B                POP EBX                                                                             ;  14D70138
00932BCD   \.  C2 0800           RETN 8

so I found that using ollydbg , well first I thought this cipher could be XTEA but XTEA does not do AND on the plain text , so I thought I may post this cipher here maybe someone Identify it and tell me wither it's an existing cipher or this is a custom cipher and I need to write it based on this asm code. thanks.

share|improve this question

closed as too localized by mikeazo, Paŭlo Ebermann Apr 26 '12 at 20:40

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

    
At least you posted the source, and not just a random bunch of bytes, like most that ask such a question do –  CodesInChaos Apr 25 '12 at 14:18
    
@CodeInChaos yeah ;P , now I hope I get an answers xD –  MixedCoder Apr 25 '12 at 14:26

1 Answer 1

It looks like a 16 round block cipher with a 2*32 bit block size and large S-boxes that are combined in a Feistel structure using alternating xor and add instructions. That points to BlowFish.

share|improve this answer
    
could it be PI fraction (NIMBUS / BLOWFISH) –  MixedCoder Apr 25 '12 at 15:54
    
This is at least not this Nimbus en.wikipedia.org/wiki/Nimbus_%28cipher%29. I am quite confident it is BlowFish, but then again, the assembler code you posted doesn't contain all information required to prove that. The method body in your quote seems implement some form of thiscall calling convention I am not entirely familiar with. –  Henrick Hellström Apr 25 '12 at 16:01
    
the decrypt function is where it call yo3.003A27A0 which I posted above then when it's return to goes here pastebin.com/7ZjBexPu –  MixedCoder Apr 25 '12 at 16:20
    
That code does little more than call something, and then copy the block byte by byte onto a destination buffer. It just proves the block size is indeed 64 bits. –  Henrick Hellström Apr 25 '12 at 16:23
    
Let me put it this way: Do you have any reason for suspecting this is not BlowFish? Do the test vectors not return the expected result? –  Henrick Hellström Apr 25 '12 at 16:26

Not the answer you're looking for? Browse other questions tagged or ask your own question.