Impossible is not french Applying a scoring method to guess the key	Javascript
16 june 99	by Laurent
	Courtesy of Fravia's page of reverse engineering
fra_00xx 990616 Laurent 1100 NA PC	Amazing work by Laurent, a Javascript Lizard that has turned into a javascript wizard :-) Read, meditate, think. Humans can reach the stars, and reverse javascript. Enjoy!
	There is a crack, a crack in everything That's how the light gets in
Rating	( )Beginner ( )Intermediate ( )Advanced ( )Expert

In this essay I'll try to explain how I did to guess a working key for the

impossible entrance. Note that I said a working key, not the correct one. This is

because, even if that key works fine, it leads to a 404 page. So maybe it's not

the correct one.


Although I really think it's the correct one :)

     ;< /        eval        '+"o        "ti"         + "        +'ef        "'nE        AcK.        'ml'        < );

6gy.=gvlq:z91=uowwYsM+w86gyrQnzpPfI!7jFrBpWAy'H86jTJAlzly I!8lMNCoywG=H7~myrBpyF5aH~dSWYWSF2rkG!#HCoBnPDw@I~#fBtCkwep'E86g

_____rCrA________rCrA________rCrA________rCrA________rCrA________rCrA________rCrA________rCrA________rCrA________rCrA_____

     ;< /*       eval        '+"oc       "ti"<        + ".       +'ef'       "'nE"       AcK.h       'ml'+       < );<    

_____rCrAc_______rCrAc_______rCrAc_______rCrAc_______rCrAc_______rCrAc_______rCrAc_______rCrAc_______rCrAc_______rCrAc___

    0;< /*       eval       l'+"oc      +"ti"<      ' + ".      "+'ef'      +"'nE"      rAcK.h      +'ml'+      "< );<    

____ErCrAc______ErCrAc______ErCrAc______ErCrAc______ErCrAc______ErCrAc______ErCrAc______ErCrAc______ErCrAc______ErCrAc___

#include <math.h>

#include <stdio.h>

#include <conio.h>

#include <stdlib.h>

#include <string.h>



//this is the original ciphertext

char* b="6gy.=gvlq:z91=uowwYsM+w86gyrQnzpPfI!7jFrBpWAy'H86jTJAlzly "+

        "I!8lMNCoywG=H7~myrBpyF5aH~dSWYWSF2rkG!#HCoBnPDw@I~#fBtCkwep'E86g";

//this is the original 'alphabet

char* a="@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234"+

        "56789~!#$%^&*():;/.\t\r -'+\"=";





//this function return the indexOf the char 'c' in the 'alphabet'

int cton(char c)

{

 int i;

 for (i=0; i<strlen(a); i++) {if (a[i] == c) return i;}

 printf("error\n");

 return 0;

}



//This function simply decipher the OrigString with the 'key' .

//The result is returned in OrigString

void decode(char* OrigString, char* key)

{

 int i;

 int pos = 0;

 char first, second;



  for (i=0;i < strlen(OrigString);i++)

  {

   first = OrigString[i];

   seconfiltered= key[pos];

   if (seconfiltered== '_') OrigString[i] = ' ';

    else OrigString[i]=a[(cton(first)-cton(second)+strlen(a))%strlen(a)];

   pos = (pos+1)%strlen(key);

  }

}



//This function return a valid key from a pair of cipher and plaintext.

//both cipher and plain text must have the same length

void getkey(char* cipher, char* plain, char* key)

{

 int i;



 for (i=0; i<trlen(cipher); i++)

 {key[i] = a[(cton(cipher[i])-cton(plain[i])+strlen(a))%strlen(a)];}

 key[i] = 0;

}



//This function was added when I wanted to 'score' each obtained plaintext.

//It return the number of time the plaintext 'st' contain the string in the tips array.

int check(char* st)

{

 int i,j;

 int score = 0;



 char* tips[11] = {"rep","lac","re","loc","ati","ht","lo","ca","oc","\"","+",};



 for (i=0; i<strlen(st); i++)

 {

  for (j=0; j<1; j++)

  {

   if (strncmp(&st[i],tips[j], strlen(tips[j])) == 0) score++;

  }

 }

 return score;

}



void main(void)

{

 char temp[128];

 char key[128];

 char tempkey[128];



 int i;



 //This is the plain text we want to obtain

 char* plaintofind = "eval";      



 FILE *outkey,*outplain,*outfull;

 // outkey will contain the key,

 // outplain the plain text

 // and full both the keys and the plain text



 outkey = fopen("key.txt", "wt");

 outplain = fopen("plain.txt", "wt");

 outfull = fopen("full.txt", "wt");



/*   // This was added when I already found the start of the key.

     //It allow me to get a key char from a cipher and a plain char

//	getkey("~~","''",key);

//	printf("***%s***\n",key);

				//And then to get the result of the new key.

	 strcpy(temp, b);

	 decode(temp, "____ErCrAc__");

	 printf("%s\n%s\n",temp,b);

	 fprintf(outfull,"%s\n%s\n",temp,b);

*/





//Here start the original program...



 // It loops from the first to the last char or the cipher

 for (i=0; i<strlen(b); i++)  

 {

  //Get a cipher of the same length of the plaintext and starting at the position i.

  strncpy(temp, &b[i], strlen(plaintofind)); 

  temp[strlen(plaintofind)] = 0;



  //Check if we didn't reach out of the cipher

  if (strlen(temp) == strlen(plaintofind)) 

  {

   getkey(temp, plaintofind, key);    //Get a valid key

   printf("%s : \n",key);

   fprintf(outkey, "%s : \n", key);

   fprintf(outfull, "%s : \n", key);   //print it to files

   int keylen;



   //Then decipher the while cipher with that key padded to differents lengths

   for (keylen=strlen(plaintofind); keylen< 13; keylen++)

   {

    while (strlen(key)<keylen) strcat(key, "_");  //pad with _

    strcpy(tempkey, key);

    strcat(tempkey, key);

    strcat(tempkey, key);



    //realign the key so that it start well

    strcpy(temp, &tempkey[keylen-(i%keylen)]);        

    temp[keylen]=0;

    strcpy(tempkey, temp);       //tempkey will be applied to the whole cipher



    printf("len : %d, %s : \n", keylen, tempkey);

    fprintf(outkey,"len : %d, %s : \n", keylen, tempkey);

    fprintf(outfull,"len : %d, %s : \n", keylen, tempkey);



    strcpy(temp, b);

    decode(temp, tempkey);                         //decipher



    //This was added for the scoring : write score

    printf("%02d  ", check(temp));                    

    fprintf(outplain,"%02d  ", check(temp));          

    fprintf(outfull,"%02d  ", check(temp));           



    printf("%s\n", temp);              //write the plaintext we obtained

    fprintf(outplain,"%s\n", temp);

    fprintf(outfull,"%s\n", temp);

   }

   fprintf(outfull, "---\n");          //end mark

  }

 }

 fclose(outkey);

 fclose(outplain);

 fclose(outfull);



 int ch = getch();

}

To conclude, once you got the trick they used it's not so impossible finally :)




Just a last thing ... I'm not french ... Just french speaking !

---

homepage links search engines +ORC students' essays academy database
tools cocktails bots wars anonimity academy antismut CGI-scripts
counter measures mail_Fravia+
Is reverse engineering legal?

---