A858DE45F56D9BC9 archive

201209041030 zb8r3

explained decrypted filler

seed 791

Metadata

Post ID
zb8r3
Title
201209041030 → 2012-09-04 10:30 on A858's clock
Posted (UTC)
2012-09-04 01:30:09
Timezone
UTC+9 · title 10:30 against posted 01:30 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,512 hex characters · 1,256 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201209041030) = 3b8dba3a197c27da6a587059bce4afa9 (name+title)
GUIDs
39
Filler GUID seed
new Random(791).Next(9) ✓ verified
Run
Run 27 (seed 1,337,299,625) (seed)
Draw
41 · predicted N = 39 ✓
Machine boot
2012-08-15 10:07–10:24 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
5 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

09EB19197980CC75 02408466F12E26BC F02F1AF5A8CEBEB8 74F0E6C533518923 3404BEAFD2BAE8B2 B82FEB7CC6DE0428 5EB7DC160FBAA132 C9C614FCF9F30372 2A788AA741DB4359 6F32D02F907B301B 5ECF705C10FFDD51 13911BFB6E5ED916 09FD823FACFD5B36 27CEC952BA6DE207 BED95E162DC18D89 C06914AC43119424 706D0DA106D6DE8E 030494552B04BA46 F92B416B6C542B39 9E5D348EF97E0ABE 3AEF671647E251B7 7EC6F978D823CF98 42A64BBDB05F9CE6 568B332F3001AB49 19167ABA0B80C27C 2980557A8A1D1981 7EC822FD81DF9272 482AF886168192B3 B6BA8218E7BB95FD AFBB002FFDD5AB4B FA950E04684A508F B90AB4A5E52BD0AF F4A4FEBABDF4341C 84C860CA6166DCB0 E67A6B0B107A4AE3 25CB970018ADF85A B90A9858299A7CD2 80121E8D333B30E0 224743F7B67246D2 17AB3E324BD2425C D9EF97E37F1EB7E7 867B252B3E2BFAA2 AAF6F4238F599F20 ABA64B6DDA5F5D82 F3EA9B12773B254D D00EFD4D87A493AF E39B59C2F7857281 76C4F4428BC4B789 C878704E98FF6E7A 2E11DF298D0B77C5 F36D7B530D27E0C9 CEA28E7137E24F0A 96EF5327F6289DA9 21A24537B92DD924 2929EAF7BB0D82FE B95CEB356AB8E8B0 551BA1BC79574858 16F5539915005FA7 87B4A34F2661804A 547AEF1E0028DF5C 62377360DFEA5C1A C68118BD40E709A2 3B3E15338224BD39 9B02919E33018316 F742790409D7C332 F0904B65B14FA80B 80CBFDA9A99A2947 8776E7FF37E52001 5696721F07DD6F12 2AE0B187871D6822 FFF26B57D8A1BAED F6D0F6272327D40E 11B01C72CAE93F1C 25B8635403A9D61D 7A9C788C1062AFB1 E78247D3B7FAEADC 4535E8DD38F445D5 FD075DD04BDCA408 49E09A293699743C 61F85A0AB992EDC7 DDC393732792BAFB E88B1F4C8A03235E CE243753BBD1CEC6 B8F75682983DB178 83450668A91AA98A 37CB46E09E8C517C A0E2072723165860 25DB17699D6E780F 78355ABCCDE61D89 A74B2332E7148CA7 470821674CAB3076 1ABA98C605C4399F DADA5BE2F9FC2DEC 8E228F4CE6276D6B C55EB7A21C4B1E3A 923E40547A6A4541 0CB34767D68DCFFB C6BBF13A6725CC89 1C4E77B5DA6ADB3D 72B923C0E0F381A6 64945C8089195807 B99A7989BB6386E2 9B3DB443E7D7FCCD D34AA51055E4E705 E0F7696ADBC351FF 18EE9CE31E71F396 75E57CCCE3A58A90 340C388788250B8F 982D387E58571869 50EA4EE7FA8127E6 BA828345A187731B 0DFCFADE2FF31E5F 39E8C1DB7FB5FC55 8A53D48120FCDCCA 9F2080C8334C94D8 80DB8B486DDD16FD 79A306591614A523 3558AC7CBAEC3FB8 C9061F090F82B2D9 AC7E0C459F9042B2 84BB5FB7A5A71BE3 4957479280D5CA3D 571E484B384D7498 4D35555F028A57AD 0C0D66F77FEFE290 1A6ED3BF13443E13 95FC70434318356C 6F4413F73432CE62 83F01BD04A9F1A24 A81C7888290ACCF7 3370A69E563D57EA 06C5E7444EE6C8F7 F6BFAC775E9F3DEA 63CA29F27F61C911 D812368DA7845CC8 C34C5D097C04FE4F 4EEFEF98CF5C3974 9517CCBA9561E20D 762ECF4DD8DBBD99 744FF45CF89D5F22 D19DBCC9F54C144F 433DCFA5D2D43884 689DD61579420560 282E59C2E5C81B98 CFFD41BFC9B4A641 F8CE268C5B7121CC 4805A5F4569D8078 C2B0FF5806C400E9 365D686E63F7A61E 5C90A602AC3AB124 157885213127AF47 86E82F58B3FDD6DF 447ADA98F1DB21E6 C4325686BAC211C4 2DEF6A66EF54A8BA 9D88DB4E0C5BD3FD 5F98252948060D97
  • Read the ciphertext. Strip whitespace: 2,512 hex characters = 1,256 bytes = 157 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201209041030 (name+title). Key = MD5(password) = 3b8dba3a197c27da6a587059bce4afa9, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 39 GUIDs as hex (shown below).

Decrypted: GUID list

  1 171e9107-7e01-89f5-977d-3f90d9bec821
  2 b19a4717-a8c3-86ff-9287-79329fd13c2c
  3 71d0bf7a-04d9-6fa8-97e7-87b18e618c61
  4 9573f96a-5d04-3d05-b610-ec52b0035ee1
  5 f9ed282e-c363-2c5a-8eaa-02840370891a
  6 fd7b575a-526c-7354-94bd-33e8ecef31dd
  7 9bd25b6f-01e0-2cd6-b902-8677099e0724
  8 bc8eff53-9f99-2dde-8116-5bf26d0c62fa
  9 299036b2-c096-7ab1-ab1c-2e9c13a07637
 10 45d6e50a-18aa-8579-8f65-cc2558dafb29
 11 4677d386-a092-00f7-be36-1e41bbc644c1
 12 c26a08ca-3d94-028b-98dc-8123c04b4ad5
 13 f8c93954-5c0e-3bb8-9b88-f1c08560ed67
 14 6031ec8e-c1dd-84ce-be44-05175e0fce92
 15 1f8d4dea-a4c6-580f-941c-c346f4c222d4
 16 9737ba75-0f17-055c-98f5-484364ff5a9c
 17 d5dc5e4f-7716-34fb-8cf4-b4ea1fcba2e8
 18 a294df1f-efc5-3a83-90ca-7fea5edd99f9
 19 f5ab9b7e-8097-019a-b2c5-d9524f307615
 20 16059ebe-468f-5f3d-8d30-567eb7332c4b
 21 cc29a540-14e6-8e26-a00d-2463a114f9fd
 22 294a3bae-1ea8-856d-98b9-ee05bb32498d
 23 420365c5-9c48-627b-960a-d7156e2b7779
 24 99d0073d-ed8d-316b-a618-bb65ddc4f270
 25 59f4af98-8dff-2417-916b-490e4b422425
 26 9be9e616-04df-2f9d-9905-559dd9a59466
 27 3237cae2-24b5-0302-8963-71d9eb2416bc
 28 81bea614-fff0-752d-9fbe-5fa89d8add50
 29 3395272f-1c8b-0f87-895a-b97297a9f815
 30 1669c943-45b9-1996-a9fd-68ce1771e985
 31 93bf0ef7-a70d-1aa5-85a8-0e3e7190cc6b
 32 4edfedb7-6ccf-7288-8e38-44eea36986e2
 33 b17ece4e-b35d-3b8a-9b30-490faee6ff55
 34 3ffcafd0-8e20-7c7e-8e5b-f1c78000c66b
 35 f88af92a-b752-789d-9a35-b35ebed4648a
 36 d149fa9a-aa38-09cf-b8de-ffc16e3d673f
 37 2d62c9ee-9025-29b7-ac50-6c144f537ec1
 38 9c1aa8df-0e2d-429d-815a-aca75a4bef48
 39 852aacf5-a3e2-71bd-ad02-4889b2b8c800

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 886327227800385033058863220701173770247. Exactly this sequence comes out of new Random(791).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 41 of Run 27 (seed 1,337,299,625): new Random(1337299625), Next(8,64) per post. The RNG predicts N = 39; the post has N = 39 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:07–10:24).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs