Impossible is not french Applying a scoring method to guess the key	Javascript
16 june 99	by Laurent
	Courtesy of Fravia's page of reverse engineering
fra_00xx 990616 Laurent 1100 NA PC	Amazing work by Laurent, a Javascript Lizard that has turned into a javascript wizard :-) Read, meditate, think. Humans can reach the stars, and reverse javascript. Enjoy!
	There is a crack, a crack in everything That's how the light gets in
Rating	( )Beginner ( )Intermediate ( )Advanced ( )Expert

In this essay I'll try to explain how I did to guess a working key for the



impossible entrance. Note that I said a working key, not the correct one. This is



because, even if that key works fine, it leads to a 404 page. So maybe it's not



the correct one.




Although I really think it's the correct one :)

     ;< /        eval        '+"o        "ti"         + "        +'ef        "'nE        AcK.        'ml'        < );



6gy.=gvlq:z91=uowwYsM+w86gyrQnzpPfI!7jFrBpWAy'H86jTJAlzly I!8lMNCoywG=H7~myrBpyF5aH~dSWYWSF2rkG!#HCoBnPDw@I~#fBtCkwep'E86g



_____rCrA________rCrA________rCrA________rCrA________rCrA________rCrA________rCrA________rCrA________rCrA________rCrA_____

     ;< /*       eval        '+"oc       "ti"<        + ".       +'ef'       "'nE"       AcK.h       'ml'+       < );<    



_____rCrAc_______rCrAc_______rCrAc_______rCrAc_______rCrAc_______rCrAc_______rCrAc_______rCrAc_______rCrAc_______rCrAc___

    0;< /*       eval       l'+"oc      +"ti"<      ' + ".      "+'ef'      +"'nE"      rAcK.h      +'ml'+      "< );<    



____ErCrAc______ErCrAc______ErCrAc______ErCrAc______ErCrAc______ErCrAc______ErCrAc______ErCrAc______ErCrAc______ErCrAc___

#include <math.h>



#include <stdio.h>



#include <conio.h>



#include <stdlib.h>



#include <string.h>







//this is the original ciphertext



char* b="6gy.=gvlq:z91=uowwYsM+w86gyrQnzpPfI!7jFrBpWAy'H86jTJAlzly "+



        "I!8lMNCoywG=H7~myrBpyF5aH~dSWYWSF2rkG!#HCoBnPDw@I~#fBtCkwep'E86g";



//this is the original 'alphabet



char* a="@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234"+



        "56789~!#$%^&*():;/.\t\r -'+\"=";











//this function return the indexOf the char 'c' in the 'alphabet'



int cton(char c)



{



 int i;



 for (i=0; i<strlen(a); i++) {if (a[i] == c) return i;}



 printf("error\n");



 return 0;



}







//This function simply decipher the OrigString with the 'key' .



//The result is returned in OrigString



void decode(char* OrigString, char* key)



{



 int i;



 int pos = 0;



 char first, second;







  for (i=0;i < strlen(OrigString);i++)



  {



   first = OrigString[i];



   seconfiltered= key[pos];



   if (seconfiltered== '_') OrigString[i] = ' ';



    else OrigString[i]=a[(cton(first)-cton(second)+strlen(a))%strlen(a)];



   pos = (pos+1)%strlen(key);



  }



}







//This function return a valid key from a pair of cipher and plaintext.



//both cipher and plain text must have the same length



void getkey(char* cipher, char* plain, char* key)



{



 int i;







 for (i=0; i<trlen(cipher); i++)



 {key[i] = a[(cton(cipher[i])-cton(plain[i])+strlen(a))%strlen(a)];}



 key[i] = 0;



}







//This function was added when I wanted to 'score' each obtained plaintext.



//It return the number of time the plaintext 'st' contain the string in the tips array.



int check(char* st)



{



 int i,j;



 int score = 0;







 char* tips[11] = {"rep","lac","re","loc","ati","ht","lo","ca","oc","\"","+",};







 for (i=0; i<strlen(st); i++)



 {



  for (j=0; j<1; j++)



  {



   if (strncmp(&st[i],tips[j], strlen(tips[j])) == 0) score++;



  }



 }



 return score;



}







void main(void)



{



 char temp[128];



 char key[128];



 char tempkey[128];







 int i;







 //This is the plain text we want to obtain



 char* plaintofind = "eval";      







 FILE *outkey,*outplain,*outfull;



 // outkey will contain the key,



 // outplain the plain text



 // and full both the keys and the plain text







 outkey = fopen("key.txt", "wt");



 outplain = fopen("plain.txt", "wt");



 outfull = fopen("full.txt", "wt");







/*   // This was added when I already found the start of the key.



     //It allow me to get a key char from a cipher and a plain char



//	getkey("~~","''",key);



//	printf("***%s***\n",key);



				//And then to get the result of the new key.



	 strcpy(temp, b);



	 decode(temp, "____ErCrAc__");



	 printf("%s\n%s\n",temp,b);



	 fprintf(outfull,"%s\n%s\n",temp,b);



*/











//Here start the original program...







 // It loops from the first to the last char or the cipher



 for (i=0; i<strlen(b); i++)  



 {



  //Get a cipher of the same length of the plaintext and starting at the position i.



  strncpy(temp, &b[i], strlen(plaintofind)); 



  temp[strlen(plaintofind)] = 0;







  //Check if we didn't reach out of the cipher



  if (strlen(temp) == strlen(plaintofind)) 



  {



   getkey(temp, plaintofind, key);    //Get a valid key



   printf("%s : \n",key);



   fprintf(outkey, "%s : \n", key);



   fprintf(outfull, "%s : \n", key);   //print it to files



   int keylen;







   //Then decipher the while cipher with that key padded to differents lengths



   for (keylen=strlen(plaintofind); keylen< 13; keylen++)



   {



    while (strlen(key)<keylen) strcat(key, "_");  //pad with _



    strcpy(tempkey, key);



    strcat(tempkey, key);



    strcat(tempkey, key);







    //realign the key so that it start well



    strcpy(temp, &tempkey[keylen-(i%keylen)]);        



    temp[keylen]=0;



    strcpy(tempkey, temp);       //tempkey will be applied to the whole cipher







    printf("len : %d, %s : \n", keylen, tempkey);



    fprintf(outkey,"len : %d, %s : \n", keylen, tempkey);



    fprintf(outfull,"len : %d, %s : \n", keylen, tempkey);







    strcpy(temp, b);



    decode(temp, tempkey);                         //decipher







    //This was added for the scoring : write score



    printf("%02d  ", check(temp));                    



    fprintf(outplain,"%02d  ", check(temp));          



    fprintf(outfull,"%02d  ", check(temp));           







    printf("%s\n", temp);              //write the plaintext we obtained



    fprintf(outplain,"%s\n", temp);



    fprintf(outfull,"%s\n", temp);



   }



   fprintf(outfull, "---\n");          //end mark



  }



 }



 fclose(outkey);



 fclose(outplain);



 fclose(outfull);







 int ch = getch();



}

To conclude, once you got the trick they used it's not so impossible finally :)








Just a last thing ... I'm not french ... Just french speaking !

---

homepage links search engines +ORC students' essays academy database
tools cocktails bots wars anonimity academy antismut CGI-scripts
counter measures mail_fravia+
Is reverse engineering legal?

---