Re: 100$ prize as Rocky's password scrambler is released
Hi folks,I took a crack at this earlier.Here is a copy of the source we were able to reverse, along with my notes on the process. This seems to be a nice piece of crypto, but I am not a crypto expert unfortunately, so I can't say if it has any easily spotted vulnerabilities in it.The choice of key length seems a bit suspect, as it will use a min of the key length, rather than padding out the key to a known length. That said, I don't know enough about cryptonalysis to see where this leaves weaknesses.I would recommend looking for the constants that we have here, to see if they are part of a known crypto algo, in either plain or hex form.The brute-force solution will take forever if we run it up, it's not really something we could reasonably run, though it would eventually give us an answer I'll add this contributio
n in the hopes that somebody can move further with it, and use it as the key to unlock the actual algorithm in use.PyInstaller Extractor was used to reverse this, so it's probably good to add another level of protection on top of what you have.The code which we have reversed contains comments and other information, so I have abstracted it out to scramble and unscramble functions.Whereas the original code works by setting wheels each time, this code has been modified to set the key on encrypt or decrypt, forcing the wheels to a known statefrom __future__ import print_function
#Data structure:
#main program starts here:
def set_wheels(key):
global bigList, listA
listA = ['0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z', '!', '"', '#', '
;$', '%', '&', "'", '(', ')', '*', '+', ',', '-', '.', '/', ':', ';', '<', '=', '>', '?', '[ a-t ]', '[', ']', '^', '_', '`', '{', '|', '}', '~', ' ']
list1 = ['s', '=', 'o', '[ a-t ]', '.', 'O', 'y', '!', '^', 'H', 't', 'l', 'W', 'p', 'v', '<', 'N', 'k', 'c', 'A', 'B', 'P', '}', 'i', 'L', ']', 'U', 'u', '&', 'x', '#', '2', 'R', 'I', '%', '0', 'J', '[', ')', 'Y', '7', 'q', 'C', 'D', '"', '1', ' ', 'X', 'b', '*', ',', 'F', 'Z', 'V', '9', ':', '+', '`', '-', 'G', 'M', 'w', 'e', '{', 'E
', 'n', 'g', 'a', '~', 'd', '>', '?', '4', '$', '8', "'", '3', 'h', 'T', '|', 'Q', '/', ';', 'K', '6', 'r', 'S', 'f', 'm', 'j', '_', 'z', '5', '(']
list2 = ['T', 'C', '$', ':', 'f', 'D', 'R', 'u', 'J', '?', 'x', '6', 'N', '~', '[', 'M', 't', 'P', '.', 'L', 'v', '[ a-t ]', '7', '_', 'A', 'k', 'O', 'j', '&', 'o', '%', '=', 'w', 'K', '(', 'a', "'", '|', 'Y', 'F', 'y', 'n', 'X', ']', 'z', 'E', 'W', '9', '>', 's', '#', '<', 'I', ')', ';', '+', '}', 'S', 'e', 'Z', ' ', 'd', '8', 'q',
9;p', 'B', '*', 'H', 'h', 'U', 'c', 'Q', '1', '3', '5', '-', '0', '`', '2', 'b', '/', '^', '!', 'l', '"', '{', 'G', 'g', 'i', 'V', '4', 'm', 'r', ',']
list3 = ['x', 'C', '>', 'E', '8', 'd', 'S', 'O', ']', 'q', ';', 'U', '&', 'o', 'y', 'N', 'f', '2', ',', '(', '9', '[ a-t ]', '<', 'I', 'k', 's', '5', 'c', '"', "'", 'R', 'b', 'D', 'i', '`', 'B', '-', 'T', 'e', 'H', 'z', 'L', 'l', ')', 'J', '?', 'K', '^', 'g', 'V', '3', '.', '|', 'P', 'p', 'A', 'v', '!', '0', '}', '6', '_', ' ', 'u',
'=', 'G', 'X', 't', '#', 'Y', ':', '[', '/', 'M', '{', 'h', 'm', 'W', '4', '$', '7', '+', 'r', 'a', '*', 'j', 'Z', 'w', 'F', 'n', '~', 'Q', '1', '%']
list4 = ['>', 'v', '/', '1', 'N', 'H', '!', '-', 's', ':', 'U', 'F', 'p', 'q', 'I', 'k', 'z', 'A', 'y', '^', 'r', 'V', '8', '{', '`', '#', 'a', 'f', 'M', 'i', '*', '.', 'l', 'x', 'n', 'd', 'K', 'w', '|', 'R', '0', 'g', ';', 't', 'j', '5', '$', 'J', 'o', 'e', 'Q', 'u', '~', '}', 'S', 'T', 'G', '[', 'D', '7', 'P', 'h', ',', 'B', '_', '2
', 'O', 'c', '+', '(', '=', 'E', '4', 'L', 'b', 'X', '&', '3', '%', "'", 'm', ')', 'C', 'Y', '<', ' ', '?', ']', '"', 'Z', '[ a-t ]', 'W', '6', '9']
list5 = ['6', "'", ' ', '_', 'k', '3', 'D', '#', ',', 'g', 'N', 'T', 'C', '!', 'a', 'U', 'n', 'i', ':', 'd', '~', 'A', '>', 'O', 'I', '^', 'F', '4', '.', 'm', 'h', '`', '%', 'Y', 't', '2', 'e', '*', 'V', '0', 'r', ']', '-', 'b', ';', '}', '/', '"', 's', '<', 'q', 'J', 'R', '+', 'l', '&', '|', '9', 'E', 'X', 'u', 'x', 'Q', 'v', '
;[', 'w', '{', 'G', '=', 'M', '7', 'W', 'S', 'f', 'z', 'c', '8', 'y', 'j', 'o', 'p', 'K', '5', 'H', '1', ')', '?', 'Z', '[ a-t ]', '$', '(', 'L', 'B', 'P']
list6 = ['L', 'k', '|', 'E', '}', 'j', 'S', ';', 'i', '.', '>', 'N', 'n', '{', 'J', 'y', '$', 'l', '^', '/', ',', '!', '~', 'X', 'q', 'Q', '[', 'G', 'u', '8', '7', 'a', 'f', 'H', '9', 'z', '"', 'x', 'K', 'r', ')', 'P', '=', 'M', '*', '(', '_', 'e', ':', '`', '-', 'A', ']', 'p', 'F', 'V', 'v', 'T', 'U', 'D', 'O', '0', 'Z', '#', '3',
