hellman

hellman

'''
The idea is to reach a state consisting of 00 and FF bytes.
Because of the independence of shifts values, if the message block is the same 32-byte part repeated 2 times,
the state is preserved. We then can change the 32 byte part arbitrarily and keep the hash value unchanged.

To do this we first craft a 32x2 message block that lands on such state after 2nd round (1st round does nothing).
We have 32 bytes of freedom (-charset constraints), so this is reasonable and can be done with 1 byte guess and propagation.

One caveat is that the initial state is rather symmetric and and it's not always easy to land on a desired state,
so we prepend random block first to randomize the state.

hellman

prepare:
	mkfifo p1 p2

precomp:
	./stage1_precomp
	du -hs dump*
# 	17G	dump0
# 	17G	dump1
# 	17G	dump2
# 	17G	dump3

hellman

from sage.all import *
from crccheck.crc import *

def tobin(v, n):
    assert 0 <= v < 2**n
    return tuple(ZZ(v).digits(2, padto=n))[::-1]

def frombin(v):
    return sum(int(c)*2**i for i, c in enumerate(v[::-1]))

hellman

hellman

hellman

hellman

from sage.all import *
import ast, sys, subprocess
import hashlib
from random import shuffle
from time import time

while True:
    data = subprocess.check_output("nc 124.156.133.6 22298 </dev/null", shell=True).splitlines()
    p = int(data[0])
    nums = ast.literal_eval(data[1].decode())

hellman

from sage.all import *

ma, mb, mc, md = 0x505a1, 0x40f3f, 0x1f02, 0x31
maxa = maxb = 1 << 19
maxc = (1 << 13)
maxd = (1 << 6)

def hw(a):
    res = 0
    while a > 0:

hellman

from sage.all import *

cipher = 5089249888618459947548074759524589606478578815336059949176718157024022678024841758856813241335191315643869492784030633661717346809979076682611760035885176766380484743187692409876479000444892361744552075578050587677106211969169204446554196613453202059517114911102484740265052582801216204900709316109336061861758409342194372241877343837978525533125320239702501424169171652846761028157198499078668564324989313965631396082388643288419557330802071756151476264735731881236024649655623821974147680672733406877428067299706347289297950375309050765330625591315867546015398294367460744885903257153104507066970239487158506328863
e1 = 404631632429186691057151456165799596229515836470293346038946882707287286529392081426651522871043897025702106506439028114895075946268749807973667290687512894419814093148244974114798895978828271531030717098678340265519629670461128544775214995653130357468085954191024301467239122993438613247502430868685203292435795248909029555249146770214026315998267501893269257684795200