Domain Generation Algorithm (DGA) of DirCrypt

dga.py

# see http://www.johannesbader.ch/2015/03/the-dga-of-dircrypt/
import argparse

class RandInt:

    def __init__(self, seed): 
        self.seed = seed

    def rand_int_modulus(self, modulus):
        ix = self.seed                
        ix = 16807*(ix % 127773) - 2836*(ix / 127773) & 0xFFFFFFFF        
        self.seed = ix
        return ix % modulus 

def get_domains(seed, nr):
    r = RandInt(seed)
    for i in range(nr):
        domain_len = r.rand_int_modulus(12+1) + 8
        domain = ""
        for i in range(domain_len):
            char = chr(ord('a') + r.rand_int_modulus(25+1))
            domain += char
        domain += ".com"
        yield domain

if __name__=="__main__":
    parser = argparse.ArgumentParser(description="generate Dircrypt domains")
    parser.add_argument("seed", help="seed as hex")
    args = parser.parse_args()
    for domain in get_domains(int(args.seed, 16), 30):
        print(domain)

observed_seeds

18a62b7a, 98a62b79 	
1a11b7cd, 9a11b7cc 	
1fcbef63, 9fcbef62 	
22a47ee8, a2a47ee7 	
4caa1fc5, ccaa1fc4 	
52ce8a67, d2ce8a66 	
6c75a989, ec75a988 	
06e46566, 86e46565 	
72113c2b, f2113c2a 	
741fd6e2, f41fd6e1 	
78731d07, f8731d06