A858DE45F56D9BC9 archive

201201060513 o5o4o

explained decrypted manual

A masked GUID list, seed 563, inside a Base64 and hex container. 3DES, key MD5 of the header's hex string.

Metadata

Post ID
o5o4o
Title
201201060513 → 2012-01-06 05:13 on A858's clock
Posted (UTC)
2012-01-06 18:09:21
Timezone
UTC+11 · title 05:13 against posted 18:09 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
3,048 hex characters · 1,524 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(f8278df7c61e8ed0b77cb19c2b0e6e20) = be6f3c56d94933d684ba221e180aa1be (MD5 of the hex string in the post's own header)
Note
The header's last field (ff4e00a2) is not the CRC-32 of the plaintext; its role is unknown.
GUIDs
16
Filler GUID seed
new Random(563).Next(9) ✓ verified
Run
Before the scheduler (pre-automation)
Draw
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
18 · 14
Tags
pre-automation2012Encrypted masked GUID listmanualkey: MD5 of the hex string in the post's own headerrun: pre-automation

From the post to its content

As posted (encrypted)

577A4E6B5A584E64 573259344D6A6334 5A475933597A5978 5A54686C5A444269 4E7A646A596A4535 597A4A694D475532 5A5449775856746D 5A6A526C4D444268 4D6C304E436C7378 515449784F445132 4E6A6B30516A6445 4D44553052445132 4E5449354F554931 51545934526A677A 5255453252445A43 4D3049784E6B5A44 516B59304D444D33 516B49304D6A6334 4F546C424E444531 52444E444D7A677A 4D6A68434D7A5930 516A5134517A4578 526A4A444D444244 4D6A4A42517A5244 4F544978526A4935 52445242516B4933 4D3049304E446B32 525446444D305130 4F5468434E304E45 5255464751545935 4D5467344D555245 4D4455344D445978 525545354F446731 4E7A424351555A47 516B5979516A5246 526B4E47517A4D78 4F544D784D7A6378 5155557752445530 4F544A4451544E45 4D5559314D44457A 4D44424551544D77 4E5551354D7A5646 4E544977517A5642 4D7A4535517A4245 51304D784D554E42 516B453151304930 4E3059784E304A45 4D555A474F446377 4E6B49344D555534 4D305178517A4D79 51304D314D454642 4E6A5978526B5930 4D55464452455642 4D5549304D555579 4E455A4251554E44 515545324F445245 4D544A454D455979 517A417A516B5933 524459354D7A6843 4D6B52454E454579 516A51344E544645 517A45344E7A4A47 4D554933526B4934 4E444D344F544E42 4E7A4A43516A6B34 4E5555794F446845 526B46424D54597A 4F5456424E6B4642 4D6A4D30526A4931 4E4449784E546332 4E3049314D6A4245 4E446B32526B5242 517A6842516A4644 4F44633551544930 4D5551344E7A4931 515464474D454532 4E4459344D6A6377 4E5459354E445979 51554A42516B5A44 526B59304E6B4E45 4E4556424E7A4179 4D444E42526A4D79 4E7A63354E544979 52545A4251546B77 4E6A4D3151544A47 5130524451545578 4D305A47516A5A47 524555334E554E43 4E4467344D6A6333 517A6C43517A6B34 4E305244517A457A 4E5555334E7A5531 4D7A46454E6A4530 4D6A51344F546C42 4E7A6444526A5933 4E455643526A5579 4E6B5934516A5644 52446842516B5531 4E3051314D545933 516B4D78516A5133 4E446C4351555242 4E6A55794E7A4E42 4D7A6C434E555244 525467794E6A4579 4F4459334D7A6445 5154453551544645 4E5455784D554D34 524451784F444247 4D546B3051544645 516A49774D446C42 4E444D3352544531 51304D78517A4645 4E544A474F554643 526A637A4D305932 4E6A67774E544532 516A63774D7A5A46 4D6B49784E546335 4E6A6C4452444977 4D3051334E6A4E43 4D544A43516B5A43 5130553251555978 4D7A51304D554979 517A41344F444130 4D6A55344D304933 4E6A4D314E6A4A42 4E7A42444D555533 4F446845526B4D32 526A55324E7A4933 4E6A5246516A4242 4D4464474D6B5643 5255564351545532 4D4459324F555177 4F54644751544133 517A6C464D6B4533 513049334E454647 516A677A52544134 4D546330516A5577 524559354F455645 524455774E446B31 516B59784E444246 5130524451555A47 4E6A67334D6A6B32 5254453152555533 4F554647526B4A47 4E544647526A5933 52444D324E6A4D32 52444532526A4E46 4D545A47526A4979 52455647526A5933 526A45304D454D35 4F54464251545644 526A5A4552554D35 516B56474F446C44 4D6A517A4D7A6C44 4E5449354E6A677A 524451784F554645 4D6B55334D445647 4D7A5179526A6C42 517A4D784E7A6B79 516A6B304F454532 4D7A55354F554530 4E6A68444E444D33 516A49354D6B4578 51555A444D544642 4F446C464D7A6379 4E4556474D7A6B32 51304A46526A5A44 52555932517A5A46 4D4549794E7A6731 5244424551305132 4E6A52434D44597A 4F4556434E6B4534 4D454D314E545930 4E304D34526A5578 4E4449324E554E43 4D6B49314F544E46 51305932526B4532 515555794E304978 51305247526A5134 4D6B46444D546C44 4D44524251544533 525451344E454935 4F4464464D546843 526A67334E7A6C42 4E6A64444D7A5532 4D444A464D546734 4E6A51344E554A44 526A6B304D546C47 524467794D444531 516A41794F555931 4D46303D
  • Unwrap. Decode the body from hex, then from Base64. The result is a small container: [3des][f8278df7c61e8ed0b77cb19c2b0e6e20][ff4e00a2] followed by the ciphertext in hex.

Decoded from hex

WzNkZXNdW2Y4Mjc4ZGY3YzYxZThlZDBiNzdjYjE5YzJiMGU2ZTIwXVtmZjRlMDBhMl0NClsxQTIxODQ2Njk0QjdEMDU0RDQ2NTI5OUI1QTY4RjgzRUE2RDZCM0IxNkZDQkY0MDM3QkI0Mjc4OTlBNDE1RDNDMzgzMjhCMzY0QjQ4QzExRjJDMDBDMjJBQzRDOTIxRjI5RDRBQkI3M0I0NDk2RTFDM0Q0OThCN0NERUFGQTY5MTg4MUREMDU4MDYxRUE5ODg1NzBCQUZGQkYyQjRFRkNGQzMxOTMxMzcxQUUwRDU0OTJDQTNEMUY1MDEzMDBEQTMwNUQ5MzVFNTIwQzVBMzE5QzBEQ0MxMUNBQkE1Q0I0N0YxN0JEMUZGODcwNkI4MUU4M0QxQzMyQ0M1MEFBNjYxRkY0MUFDREVBMUI0MUUyNEZBQUNDQUE2ODREMTJEMEYyQzAzQkY3RDY5MzhCMkRENEEyQjQ4NTFEQzE4NzJGMUI3RkI4NDM4OTNBNzJCQjk4NUUyODhERkFBMTYzOTVBNkFBMjM0RjI1NDIxNTc2N0I1MjBENDk2RkRBQzhBQjFDODc5QTI0MUQ4NzI1QTdGMEE2NDY4MjcwNTY5NDYyQUJBQkZDRkY0NkNENEVBNzAyMDNBRjMyNzc5NTIyRTZBQTkwNjM1QTJGQ0RDQTUxM0ZGQjZGREU3NUNCNDg4Mjc3QzlCQzk4N0RDQzEzNUU3NzU1MzFENjE0MjQ4OTlBNzdDRjY3NEVCRjUyNkY4QjVDRDhBQkU1N0Q1MTY3QkMxQjQ3NDlCQURBNjUyNzNBMzlCNURDRTgyNjEyODY3MzdEQTE5QTFENTUxMUM4RDQxODBGMTk0QTFEQjIwMDlBNDM3RTE1Q0MxQzFENTJGOUFCRjczM0Y2NjgwNTE2QjcwMzZFMkIxNTc5NjlDRDIwM0Q3NjNCMTJCQkZCQ0U2QUYxMzQ0MUIyQzA4ODA0MjU4M0I3NjM1NjJBNzBDMUU3ODhERkM2RjU2NzI3NjRFQjBBMDdGMkVCRUVCQTU2MDY2OUQwOTdGQTA3QzlFMkE3Q0I3NEFGQjgzRTA4MTc0QjUwREY5OEVERDUwNDk1QkYxNDBFQ0RDQUZGNjg3Mjk2RTE1RUU3OUFGRkJGNTFGRjY3RDM2NjM2RDE2RjNFMTZGRjIyREVGRjY3RjE0MEM5OTFBQTVDRjZERUM5QkVGODlDMjQzMzlDNTI5NjgzRDQxOUFEMkU3MDVGMzQyRjlBQzMxNzkyQjk0OEE2MzU5OUE0NjhDNDM3QjI5MkExQUZDMTFBODlFMzcyNEVGMzk2Q0JFRjZDRUY2QzZFMEIyNzg1RDBEQ0Q2NjRCMDYzOEVCNkE4MEM1NTY0N0M4RjUxNDI2NUNCMkI1OTNFQ0Y2RkE2QUUyN0IxQ0RGRjQ4MkFDMTlDMDRBQTE3RTQ4NEI5ODdFMThCRjg3NzlBNjdDMzU2MDJFMTg4NjQ4NUJDRjk0MTlGRDgyMDE1QjAyOUY1MF0=
  • Decode. Decoding the Base64 gives the text below.

Decoded from Base64

[3des][f8278df7c61e8ed0b77cb19c2b0e6e20][ff4e00a2]
[1A21846694B7D054D465299B5A68F83EA6D6B3B16FCBF4037BB427899A415D3C38328B364B48C11F2C00C22AC4C921F29D4ABB73B4496E1C3D498B7CDEAFA691881DD058061EA988570BAFFBF2B4EFCFC31931371AE0D5492CA3D1F501300DA305D935E520C5A319C0DCC11CABA5CB47F17BD1FF8706B81E83D1C32CC50AA661FF41ACDEA1B41E24FAACCAA684D12D0F2C03BF7D6938B2DD4A2B4851DC1872F1B7FB843893A72BB985E288DFAA16395A6AA234F254215767B520D496FDAC8AB1C879A241D8725A7F0A6468270569462ABABFCFF46CD4EA70203AF32779522E6AA90635A2FCDCA513FFB6FDE75CB488277C9BC987DCC135E775531D61424899A77CF674EBF526F8B5CD8ABE57D5167BC1B4749BADA65273A39B5DCE8261286737DA19A1D5511C8D4180F194A1DB2009A437E15CC1C1D52F9ABF733F6680516B7036E2B157969CD203D763B12BBFBCE6AF13441B2C088042583B763562A70C1E788DFC6F5672764EB0A07F2EBEEBA560669D097FA07C9E2A7CB74AFB83E08174B50DF98EDD50495BF140ECDCAFF687296E15EE79AFFBF51FF67D36636D16F3E16FF22DEFF67F140C991AA5CF6DEC9BEF89C24339C529683D419AD2E705F342F9AC31792B948A63599A468C437B292A1AFC11A89E3724EF396CBEF6CEF6C6E0B2785D0DCD664B0638EB6A80C55647C8F514265CB2B593ECF6FA6AE27B1CDFF482AC19C04AA17E484B987E18BF8779A67C35602E1886485BCF9419FD82015B029F50]
  • Derive the key. Key = MD5 of the 32-character hex string in the header = be6f3c56d94933d684ba221e180aa1be.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding.

Decrypted: GUID list

  1 f895f09d-4612-71f3-a752-117f613929b9
  2 fb9122b2-d2c9-03d5-81d4-47d49188e229
  3 bebd8598-d38d-2366-bfee-002b72fa3696
  4 77ccaee6-de95-6f20-a981-9079dea8eb2f
  5 ad96e217-af78-3bc3-9253-9876776180d5
  6 0da14e80-d3dc-5a7c-b824-671e73dc0107
  7 e8a0f6d9-dea5-1c17-aad4-2e6718897d3c
  8 d8ebfb92-29d8-844c-9e49-0454e750cf9c
  9 4e63c302-f888-52aa-bf6e-b6364c67f93d
 10 572d6c5f-9dcd-71b5-b7a9-dd45d406be8d
 11 1660a6c0-4f25-07be-9006-5b425e275579
 12 6001fd73-724f-05ab-bba6-7b0b02842f62
 13 d070db18-6fd7-64d7-84fc-9301b32a38bb
 14 26ec84b8-a411-3d7d-acc9-3ff30df62561
 15 43bc2eec-fc6f-0232-ae3b-e39b3a661ba6
 16 91236025-d7a2-5e41-ae47-2e1e011e97fd

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 7026351857006305. Exactly this sequence comes out of new Random(563).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. Grouped in Before the scheduler: before the scheduled app (Jun 26 2012): sparse single tool runs / hand lists (o5o4o, jbucr, jkuyr), 2011 genuine-v4 lists; no long-lived count stream to fit
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Solution summary

Method
MD5(k), k = post's own [3des][k][iv] header field, ECB
Result
seed 563
Explanation
Pre-cutover filler under MD5(k), k = post's own [3des][k][iv] header field, ECB; before the scheduled app (Jun 26 2012): sparse single tool runs / hand lists (o5o4o, jbucr, jkuyr), 2011 genuine-v4 lists; no long-lived count stream to fit; list seed 563 from the GUID masks (seed 563)

Related

Findings: Mask digit · Count RNG & runs