0
$\begingroup$

I wasn't sure where else to ask this so I will ask it here.

I work for a company that uses a rather old piece of tooling and we use customized software to control it. We hired a guy to code the controller for us, and it works fine, however, we caught him stealing and fired him. After we fired him, we found out that he's coded in a check that is comparing an encrypted file to the serial number of the machine so we can't use the code on any other machine on the floor(we have ten of these things). I looked at the code in hopper, and it appears that this is simply the serial number AES encrypted somehow. Knowing this, would it be possible to reverse engineer the file so that we can create this file for each of the machines?

$\endgroup$
  • 6
    $\begingroup$ Why don't you just remove the part of the code that checks that thing? $\endgroup$ – otus Aug 17 '16 at 16:26
  • 1
    $\begingroup$ We don't have his source. In the disassembler it looks like he intentionally obscured it so a quick workaround like that isn't possible. $\endgroup$ – user38658 Aug 17 '16 at 16:52
  • 7
    $\begingroup$ @EdarThorssen, it sounds like company problems run much deeper than your current problem. You all hired a guy to code a controller for you, yet you don't have his code. So he was paid to write code, only gave you the binary, the binary had "features" that prevent you from properly using it. I don't see any cheap ways out of this mismanagement. $\endgroup$ – mikeazo Aug 17 '16 at 17:11
  • 5
    $\begingroup$ That said, if you have the binary, you should be able to patch the binary to not require the check. $\endgroup$ – mikeazo Aug 17 '16 at 17:12
  • 1
    $\begingroup$ Yeah, pretty deep hole you've got there. What are you going to do if you find bugs in the software? No source to fix and no support to call. Just rewriting it would likely be at least the long term solution. $\endgroup$ – otus Aug 18 '16 at 6:19
2
$\begingroup$

AES is a symmetric cipher — it needs the same key for encryption and decryption. Thus, in order for the code to encrypt anything with AES, it must have the key stored somewhere. Find that key, and you will have completely broken the encryption.

(It's possible that the key isn't stored directly, but is derived from some other data stored in the program code. It's even possible that the key depends on the machine number in some way; this would make it impossible to decrypt the encrypted number without already knowing the real machine number, but for just verifying that the numbers match this would be fine. In any case, as long as you know what inputs the key is calculated from and how, you can repeat the same calculation yourself.)

All that said, I'd really recommend tossing out the code and getting someone more trustworthy to rewrite it for you. You already know that the original author cheated you, obfuscated their code and included at least one hidden booby-trap in it. Do you really want to take the risk of bypassing that trap and using the code, only to find out that the next trap will physically damage your machines? Besides, with only an obfuscated binary, you won't be able to fix the code when (not if!) you find a bug in it, anyway.

| improve this answer | |
$\endgroup$
0
$\begingroup$

If the code is comparing something (the encrypted serial number, you think) with an encrypted file, and doing one thing if it is equal and another if it isn't, then don't bother to change the 'something' or even work out what it is. As a first stage, try making the code do one thing if it is equal and the same thing if it isn't. It wouldn't work if I had written this code, but he may not have thought of it.

Where does the serial number come from? Is it programmed into a ROM or some other piece of hardware? Why not just fake the serial number? It might involve a little soldering, but soldering is easier than programming,

That said, if the "rather old piece of tooling" has any safety-related functions, then switch it off now and leave it switched off for ever. If it can be programmed to injure or kill someone, then your (ex-)worker has probably done this.

| improve this answer | |
$\endgroup$

Not the answer you're looking for? Browse other questions tagged or ask your own question.