201206271115 vnzyb
explained decrypted filler
3DES(name) ECB, 23 GUIDs, seed 923
From the post to its content
As posted (encrypted)
26B59095F7A22F2C F95EA3439938C0AA 99DB51796545AE00 00723976C6232407 28AA781C25C6FFFF 8EDB028E07E7DEE9 E76EBB71E98F4672 171A1EA5A287584C 9AA160BEA7C19083 547DD4DF8B0CC4F5 DFAD71CF875F5B9A 500771E13B1FDCAE 8410E34364795B86 7A902B8224D26ACB 2EC4FDAAD821C664 6F16C4FDEA0E411E 247D68873FB29096 72BDDCF949153389 2CC0EF4A48172FC7 1DD30377310D9871 9CAAC007D1344851 5E7B3B7646ED554F 04F4B609B2989879 82585896F73FCEAB C77B017A9F791CE2 98F3273DD84322FC DE042FD4C7E96595 C8E254F4602FED13 8501BEF4BC7652F0 57C38BEC38682572 8EF1092091FA28DD 6A2A3999A8D4C899 A426FEF99E804741 456848E232ED8964 748E2617B85BDF06 4CC41B45F7F4D76D E2304EE18785B193 1267DC34B754839E 4E0BC4FADA61039F A988F03B69B258C2 4938AE1D4D94B4FF 38A13E3CCDBBAA70 621E795A6542C61B 7CFF96E4BD97B129 82063F2F9E8186FA 1471D27544E39CBE 6FE28C317D84BFEE 3044E35EA7487DF0 C2146207CDD923E8 FB62F2772B7C899C 8861FFC156DF6DD4 2FB2432266C5D71A 00D687957EC799C1 477039C3BB862E4F FC385F251AFD2DB8 431D343110E08A65 F3DF0CE3C16D07E0 0F8DBBBED7B745B3 7537A850FDDAF032 95E485EDB533DAE5 030BEFEB34AAB912 1713791F559A1326 1ED89F516AAA7945 7BA649C85FB402A1 304CD4546E0799F2 EB4ADBF26E653C2E E4415CD7AE225FC7 53FC9C2C0DB2FDCD 05738C138DF6B515 6C171EA193489254 3A2271380779FC3B BC8E95D923F5A324 545511653DFFBB9D F9A9AD8540C1BD29 B27D88FCF025FAC9 CFB73E25DF4F49AE 682F3B1737CD2B62 A9043494EBC3FC8F 24C205B79C1A3DB1 C863F08D725C4A81 32958A928B1720FA 63BA588EF1A13897 C5763AC6ABA00219 BA637237627CE43E 025B98346910B60D DF4ADE9AA3F2317F 8B23232C4D595C8A 5255E8A37E2A7FF3 00C0A71D2B12036A 532005CFD37AC820 E05A278AAA8B1A28 ECC9298E6C7F6036 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,488 hex characters = 744 bytes = 93 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 23 GUIDs as hex (shown below).
Decrypted: GUID list
1 953f8625-4966-84c8-a2e8-f67a6edde190 2 1842bee8-c18c-58cf-9809-7be88333b06e 3 54385416-28bb-8ad1-8503-baf801d2980b 4 b5b5f73f-02b9-5c47-9281-e9bab5ad4e7b 5 447d20aa-1053-8d56-826d-22cc341648b7 6 bc796f6f-c38e-199d-a69a-a24ddfac3853 7 18a95f54-eb03-4a1f-aef7-90840a22f873 8 ba34e219-e124-4cd2-aa0a-dc09e04fd200 9 e4f3a697-26d2-16b1-aa02-1b41b9818ccb 10 54ab0ba8-7870-5d13-afb5-c9ab381d5fc7 11 b09798a3-0738-298e-8482-2b8b45e4a433 12 3e8f462c-51ae-0c83-ae71-7b89f3843dbe 13 6839512e-e33b-1257-b979-b5b383e3fd39 14 1c11e13d-9569-5a75-ab1a-e43eaae05da1 15 354682f9-4780-0761-b98d-57110c8eb5ea 16 fe9d17a4-b406-47d5-bedb-796c2c52f670 17 e29364fa-c500-7803-adca-73142108c0d4 18 6b4f46b2-66bf-201c-9fd9-eae33037a6b5 19 15699c66-c3e9-5f26-9350-d3bfb806aa7a 20 aaaed5a9-d2f2-6b17-878c-679b7eb2bd83 21 8823f316-8f91-4fe1-b202-3a76c3499935 22 0c65c083-b480-2794-9a28-47187e29a002 23 f8a815ff-c78f-8ca5-af61-fae545024029
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
85858144152015047256428. Exactly this sequence comes out ofnew Random(923).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 29 of Run 6 (seed 652,173,660):
new Random(652173660), Next(8,24) per post. The RNG predicts N = 23; the post has N = 23 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:06–19:16). - Conclusion. Filler. The content is fully explained by the two RNGs.