201207211259 wwrfp
explained decrypted filler
3DES(name+name) ECB, 41 GUIDs, seed 245
From the post to its content
As posted (encrypted)
99FA07F23D1A4B44 F8F8B876F9917C86 056E6F0D56C30D0A A5C8E5BB32E2690E 0BFD16326F124F58 3220F1B69FB9DFE2 46771F41581A8ACA 27C015CFCC61D0DB 7CD948430F6E90A3 E867A482AD0C27ED 30A080DE628B3F9E C238690C4368B69B 804CAF5746978E95 A6FF432728740425 6C680CB8B1C4F124 A1A84FE67C9101FF A6E028E1C08A7B84 8D028CEBDBD31811 A628527623A4778E 99539C167E9E524F D1316CE15958218E 6168B16F0A0C2FE8 D85A4627E23FC30F 4802EC73DF86CC26 71573698EBB78B46 FB4F1A113D46F7AD 75F6FE4B143EFE39 11B4B4E3D9ABA760 61AEEB1EA3F469B1 CDBE6FA82D5CD17C 9610C31242660391 899AED94E9A8D4BF E9836F4184396226 8D214A6F0EA2B038 106FC053123A57FE 1EB3A28AE1CF7EFB D0D1A69CA3094E5B A8FDCA8D90DD942B E674C080CA3DDABB 3CB089C0D5626F8A 4E6D6C7DC1FB1C5A C2ABE150FE0064E6 0831CC4513BF6446 AC9AE07B775973E4 BAC34CF77D7671DE A4B1AA11FFC9F618 BE9965E33C77715F BBBC36DCA4D840FE D209BB1CC7697531 DC7D239ADB607E5F BA50D5C91E73ACB8 3D5C0A0532DFE1F0 32F1FD6DC578B464 E313E92FF5B3066E B228D70A599DBE12 3DDAA0F19F63EB33 6C3DCC82091C3947 C926FFA60FFD4A7C 3C52260DDF0961FA EC2FAB81F360311F 36D213C5A6808088 2E191E7D82880C15 BB86089AC5F1D304 E0F563741D858262 721901E177B3F6BF F6233AB7502A057A 0F40C355EDC35EC9 FEECE835A1FC171E 815263C0DDC7B81A E68BFF742BD03AFB FFD725B85473FAF6 D1D152A1FDB08694 7B4D03E5AEE9F61D 29F092B71887F368 5D284D6140B3CF3A 42AB613F76766531 2A9C204223ED9F3D 74C3B0F732A89E81 45D2E5F761CF0A26 BB59AA9958FAFD97 D3A506305299E5FA 6EA0C0D0F76EA57F 64FC354615EAEEEE 3DC82A9CC54EABE6 87103F32D604CC39 0BDA0EACCA70FDDE 4D459FFCB0F983C5 35130CE5AE1E41E8 C7A91F55D4EC097F AB7DC39DCF1DC5E1 A475D7E9CDA1162D 29115353D60C2E64 9BCE077079C2E24C FF1AE1B0D54D43EB 186A5E60B8630CCF 7D87D1CEF457A3FB AAAFDAB26C9A1A00 17FC17421262177B BB635BDD6AEC0DE1 04F1A4CE717A3D68 05D0DA831C61BB4C 2B087784346B7DED 24B1FD5EC44AA51D D71A545AAD880908 B916A5643FF21894 BDF92EEEA08CFB8D 983860B7EDD86650 842806EF823060E5 FDEDB3706334160C C8D9E80AE1598F87 A9A7DDA897245BD3 1CFE274DC5188146 940F6770A8C82F85 B6E4FF0A489B7E34 E5DB443191DB3CCB 251FD4EB96847FAE 5904EFB73C1BFE9C CFC9E3BCD41001D8 81F0BE112B6EA2A2 96A72ACC03CE8025 EDD63E6E0C537333 13EE9466FA731156 B491B695F6265130 12521C848A760B23 E2E7DF07A791687F 7A1E1F4D254DD968 9FCCB0DF68A3E0DD CB41B2EC778806D1 D1DED9BA1BD2843F 6E8C62A82AA504B3 9745ACA86CDF0C79 FFA0A0A66786CCD9 94805C1E39BD7F61 2196A21D0584AB8E BA051B65566E0420 C7DDE6A809601E5D AECD5145F6AFCD42 5B45BA7CCDD6933A 826BC8A971C4481F ED0CFEFFCDB25909 5805513C5ACAEF56 E9DCD6046D39CF1C A09C7D8947F265F9 69A102E0339338FA 1FC0966F8B23AD9D 3D75C57E09470668 90B8AE55F352068E 2AFB5C7A21B64505 C578D5F97347A47F 47078258F78A1992 36223231D9F15979 CF2239CEC3E0BEAE 8212FBD2A16868A2 662563455917AAA9 31508571E30C7382 4768E061863C01CD 26C4DC7209544748 BA8CF0FDB576EFFB 44145C007CD4CA97 5CA11FE914CECD63 25F4EFABC403E55C A17BD8BCBE2F78DA B48B0428A3BAC9AF F98D56585211A6FA 12ECFFDF2899BD4C
- Read the ciphertext. Strip whitespace: 2,640 hex characters = 1,320 bytes = 165 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9A858DE45F56D9BC9(name+name). Key = MD5(password) =0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 41 GUIDs as hex (shown below).
Decrypted: GUID list
1 a8566c6b-efa2-6d8a-b943-07fe8894e26d 2 670e255f-c94f-64b8-b0d0-b0be5b3980a4 3 285b1c2c-f43e-0eba-bb21-f95a8c956fba 4 1411cb6d-154a-79af-810f-d6a2b2b948ad 5 566a643e-91fe-7267-bc09-58e212143e5f 6 db34f6f0-ef35-51be-8109-16060db7c0cb 7 82356c64-1235-6774-a0e0-724147cc07d3 8 e037109a-ea45-38ad-ad1a-cacbe0f1a40c 9 4d24f64a-1ea3-220b-a276-869bd10a5384 10 7fb20cf9-63ee-5774-aa6c-ecc847457bee 11 1580a526-cd36-7561-9c9b-c26cf71642a0 12 cb17ea20-962d-6f89-8f24-a9921dd9952d 13 b93737a8-d662-0ca3-9339-284bf4248ffc 14 7d11b5a4-3fd9-8763-b437-6d2651cc6daa 15 f0924f39-670c-4fb6-9e77-585f3afc150b 16 730ee6c9-82ce-0e2b-846d-140a22521f04 17 112963e2-f684-75c6-ac38-94f378109cfe 18 16b0fd4a-9822-80ab-b90c-5f12daa95398 19 c0cdcff3-5d31-25a0-85c7-210ee1e3711c 20 b2ee6b63-5164-1c5b-96f4-17b846af353a 21 77264fbb-d25f-3757-a073-05cade553e5d 22 2b8a178b-e1da-860f-8945-3b7b82b95e1b 23 09b81554-0b09-3c3a-9a9c-d7ea4bdabd56 24 9181883d-58b6-5888-9496-2d3413db3b13 25 e9a4cb5c-131a-6d0a-b21e-a794ab74ff10 26 c472e13d-3927-00ca-9af1-6217efe55e62 27 550cb1e4-443c-5939-9b59-9e8322f7548a 28 1531c42d-48de-47c1-84a6-04f786218f5d 29 a027ae39-4a79-1dc2-b177-569d6328887a 30 d3a78352-c1bf-36d2-916f-54fecf68c6bf 31 478b0892-4c4b-570c-94fb-f04555b9eccc 32 7ab4fef8-5809-85c9-aeb2-0b7f3d1b3da3 33 938a9349-63c8-765e-a11f-b2ff12796e42 34 b88bc4ac-5f90-1330-9e92-2fd89cc3fa02 35 b31528cb-1a23-154a-ad04-91a9cf229385 36 f7c76d63-1c90-331b-b111-4e05cf1fcacc 37 9250b1d3-0d3d-8957-8a0e-b13d0d25ca86 38 ed6e8e9e-960b-3a93-9fed-6225be56c41f 39 0a29d7c2-36c0-27b0-ac10-5006468ca6e8 40 862e6604-1a08-0b5a-87f7-a4b3761c1594 41 c8005d12-1b5d-5f36-93da-3792c4bfea3d
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
66077563257608407821383560541358711383205. Exactly this sequence comes out ofnew Random(245).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 30 of Run 16 (seed 39,036,328):
new Random(39036328), Next(8,64) per post. The RNG predicts N = 41; the post has N = 41 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-11 17:05–17:10). - Conclusion. Filler. The content is fully explained by the two RNGs.