Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
''' | |
The idea is to reach a state consisting of 00 and FF bytes. | |
Because of the independence of shifts values, if the message block is the same 32-byte part repeated 2 times, | |
the state is preserved. We then can change the 32 byte part arbitrarily and keep the hash value unchanged. | |
To do this we first craft a 32x2 message block that lands on such state after 2nd round (1st round does nothing). | |
We have 32 bytes of freedom (-charset constraints), so this is reasonable and can be done with 1 byte guess and propagation. | |
One caveat is that the initial state is rather symmetric and and it's not always easy to land on a desired state, | |
so we prepend random block first to randomize the state. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
prepare: | |
mkfifo p1 p2 | |
precomp: | |
./stage1_precomp | |
du -hs dump* | |
# 17G dump0 | |
# 17G dump1 | |
# 17G dump2 | |
# 17G dump3 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
from sage.all import * | |
from crccheck.crc import * | |
def tobin(v, n): | |
assert 0 <= v < 2**n | |
return tuple(ZZ(v).digits(2, padto=n))[::-1] | |
def frombin(v): | |
return sum(int(c)*2**i for i, c in enumerate(v[::-1])) |
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
from sage.all import * | |
import ast, sys, subprocess | |
import hashlib | |
from random import shuffle | |
from time import time | |
while True: | |
data = subprocess.check_output("nc 124.156.133.6 22298 </dev/null", shell=True).splitlines() | |
p = int(data[0]) | |
nums = ast.literal_eval(data[1].decode()) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
from sage.all import * | |
ma, mb, mc, md = 0x505a1, 0x40f3f, 0x1f02, 0x31 | |
maxa = maxb = 1 << 19 | |
maxc = (1 << 13) | |
maxd = (1 << 6) | |
def hw(a): | |
res = 0 | |
while a > 0: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
from sage.all import * | |
cipher = 5089249888618459947548074759524589606478578815336059949176718157024022678024841758856813241335191315643869492784030633661717346809979076682611760035885176766380484743187692409876479000444892361744552075578050587677106211969169204446554196613453202059517114911102484740265052582801216204900709316109336061861758409342194372241877343837978525533125320239702501424169171652846761028157198499078668564324989313965631396082388643288419557330802071756151476264735731881236024649655623821974147680672733406877428067299706347289297950375309050765330625591315867546015398294367460744885903257153104507066970239487158506328863 | |
e1 = 404631632429186691057151456165799596229515836470293346038946882707287286529392081426651522871043897025702106506439028114895075946268749807973667290687512894419814093148244974114798895978828271531030717098678340265519629670461128544775214995653130357468085954191024301467239122993438613247502430868685203292435795248909029555249146770214026315998267501893269257684795200 |