Packed EXE data regions

[daraknor]

Greetings. I'm attempting to decipher a protocol but I need access to some information on how the protocol is encrypted. The executable contains the data, and I have found a few keys (128 bit and 1024 bit) but I need to decipher some more data out of the EXE. PEID shows an entropy of 7.9 and doesn't recognize any packing methods with Krypto ANALyzer. Snaker's Generic Unpacker found an OEP Detected, but I don't know what to do with the value or how to use it. I have too much work to do and I'd like to turn this over to someone who knows what they are doing if possible. Please message me using AIM or skype as daraknor, or YIM as daraknor1

[TippeX]

sounds dodgy.. count me out...

[daraknor]

Well its for financial trading software. We have a free client but a financially secure protocol. Getting the keys out of the executable doesn't infringe on anyone's privacy, but it would enable us to do things at the protocol level directly. Unfortunately the trading client automation is event driven only, and I want to do things outside of the event model. We also have a problem because sleep() is severely broken, and the recent versions of the client say that if any client sleeps too much, it is considered hung and crashes it :/ I just want to read/write the protocol in a session I already have credentials for, but that requires reading the keys out of the exe, stored in some packed data region. I've been somewhat public about the idea and people are interested and supportive (emotionally and morally but not financially) but nobody I know has the skill to do packed disassembly reading. I identified 6 different data regions, I only need the crypto keys and I don't care about the rest or modifying the client in any way.

[Joe Forster/STA]

I don't get it... Why don't you contact the author of this software - and, perhaps, offer your help with fixing known problems?

[daraknor]

According to them everything is working as intended. Event driven programming based on receiving protocol data is exactly what they want. It would be nice if I could trigger events or execution too. :/ Also, financial service companies are not very interested in open source development. Client is free (as in price) but very problematic outside a small intended use case.

[DABhand]

Well as the old saying goes "tough luck" you dont own the rights to manipulate and change the software, you bought it as is only the owners can change it to function differently.