A858DE45F56D9BC9 archive

201209041630 zbqup

explained decrypted filler

seed 797

Metadata

Post ID
zbqup
Title
201209041630 → 2012-09-04 16:30 on A858's clock
Posted (UTC)
2012-09-04 07:30:31
Timezone
UTC+9 · title 16:30 against posted 07:30 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,384 hex characters · 1,192 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201209041630) = 0b09a89e3f353c2f18fc21f7e86bee61 (name+title)
GUIDs
37
Filler GUID seed
new Random(797).Next(9) ✓ verified
Run
Run 27 (seed 1,337,299,625) (seed)
Draw
53 · predicted N = 37 ✓
Machine boot
2012-08-15 10:07–10:24 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

79EEBF33C18927F6 F6E91F3BE5072790 E33153DF7E5AA9FB 54D31DFBAA1A2A6D DDB42F7BEB086C5E 359C12DF13E95EBB CC13219B5CE1665C F131418E3F2CC658 D6EB045134B20013 265E715FC682BB4B 1DF254904BB9A917 F103DEF2A1463E0D F6B6C740D15B0921 F686F77139EDD558 6CCA19EB1239538C 6CD38384AE08208F DD37520BDC39A0F4 FA758F8CD8D26279 6D6DB2F9CA9FACEA EDCA22E01BFD8AC1 B5E4225A0BFDF013 38B9199799D9FD43 4087673DAF863D4F 30701BE93748BC5C E397169DE91F262A 55D0A22075C0D711 B763A3F5BE694E8B D2E27075BA52E4EB 8582B1167E324A64 935DF850BDE04ED1 F4BFC99E12A9A0A6 63F08CFF19FC72B3 AFD80C84D640BE90 37B23BC42502C3BC 5E4C78E6652A5070 3B7F22E97C380781 8A9D7EE56657A529 15EEE0FB642F26EC E10CE999E013CA1E E149F1C5A7565BA3 6E7BC29E2680D623 10985CC0BA02C6FB B609F166756F0DD4 4697DD337B4FEAE2 5201C75F5F2749A3 CB73687000F6E049 2DC8CCFD79736879 E103CECB1E618242 4EEE6DA088A1E1B8 E8218ECBD82CC9CF 1EB241EB2A95863D 42C48FC509376551 22E3A8DC3155A6B9 E001432618228E19 C72A74E91005A8D6 E23B1BD3FE718FDE 8A050D3843D60011 C13D64BB57588056 E342E381D7F13E49 05830FA04B101DCE 8B842520832B2C91 907A0700B3BEC7EB 9B27FCAFCCB20DBB A0B7FE2B1B4BE5F1 98B1374AD9788077 5255E9F4F2E37149 3110845456985BC1 F645184D3347F6AF D2329D675FDA6C08 B6FAC178307C8250 95A19124851C145F 00160C45B0E09778 A87114A32C29432E D110B30A7E8AF729 92B4144280DC274D A1D8CDAC5CA83C3C EF0D42ED21D2AC82 8B91983AA8B3188F E4065E5F8824E59B 144330610533DB57 9CB0E2E9FC8C7281 1049E0B40EB490F1 F4D704AFAF1FC5D2 77C78D3B09DEB3B7 1AF9F8EA052D3367 6946A99DB494570F AB8380A20825C4CE A037CFD9E4E15E1C ACBF129B227352CB 6D6D3844E1768BB1 3BA56A8D3AFA6A1A CEBEA8E9FADE6D55 76B57472C51E62D4 FC106EC971641091 1BE043D47BC348F1 6D33AC3532249F07 F4EE94818947C1BF 54DEE16122677550 819F130A005560E9 8202756C64391483 77D0C07492CF667D 77EEDF148011261F 3A44AADEAC81CF90 BF20FA890755F59E 25375CF11DF36640 DA4929E279C2258A 8FE56AA7F5E8AC76 BD3BF5133C693091 7D7D2CDCD472536E 91BFA7026FC7598D 2D2C83613477B1E8 86ED81B48BB923B7 50AE7E5CA29D5EE2 058A714B9AF71C8A 5771BE79CB4CA9B4 31C5473BE426FEA1 638ADA7DF436F6D5 D5D2F8DD5484CCEE 0F4FCC053FBC9BD5 01775E8174B8901C D75ABEAEF5996425 C5DA46895E55F1FB 7B7C69F645C413EA ECEA2C8B1C1C9941 3B83432FB66C209D 8106185FB2ACF496 6073C3FD4A468233 9580A134702276A7 B752C1326D6C97F3 5ADA92DC9EA36160 FF938D9867639542 6B891CEF7BB782DD 709C5C3257F04500 F7E461FB009C794A EB9F0F0C27D91112 02B84B2C2A63F118 CF1307C03748EFF5 B095281D9DA7D532 737F7783A90FF43A 5E098FA3B3C6373A 1F78FB05BAFC7988 5D46B70432AED1E4 7CF8E3CE2898F603 8C4886D0F8D4CBAE 3C44C4AF490E3047 825A80D0C561434A 2B75ADDBD0D3436F EB935AED9088DDC6 4A5B51446D766452
  • Read the ciphertext. Strip whitespace: 2,384 hex characters = 1,192 bytes = 149 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201209041630 (name+title). Key = MD5(password) = 0b09a89e3f353c2f18fc21f7e86bee61, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 37 GUIDs as hex (shown below).

Decrypted: GUID list

  1 cfcb434e-69c5-025f-a6a8-7a10b68e8042
  2 5e9bc42e-2b94-6aef-98ae-658d7fb4cfd0
  3 2db97f18-af3b-7572-be11-c45c3d9c9d48
  4 664d200f-9beb-6433-b057-03ba37e71884
  5 0dbbb3b7-9e63-0862-b699-a994172e6bbf
  6 1965b132-26fb-00c1-9570-c1736a682d6e
  7 a03157a8-cd95-0a6b-a06d-94c318509d37
  8 0b0d28fc-eb09-2cbd-b367-8d6502af8bb6
  9 31cf53d6-773d-5de3-a268-91f191740b1b
 10 f582e669-b62b-1ce9-83bd-c29606024f11
 11 c8c941f5-1ef6-4849-bc7f-916e3f6a72ab
 12 3ec06486-4c5b-662d-9216-667db03867eb
 13 652eb972-53e3-413a-bc59-d2829c93e0f8
 14 d3e32c21-1877-1806-940d-322602bc3904
 15 cee364d8-412b-76cc-97ce-5c40b6d78f00
 16 1a29d086-dfd3-6a10-8be7-1f40da974d5e
 17 c0a006e1-6cc1-708e-ac66-6bbef9c3799a
 18 0c30edb9-a52f-1ab7-a5f5-8e4d988c9322
 19 e79b21a5-3511-2128-8e5d-458f1ecfe7f5
 20 67878e82-067a-8525-a98c-bd986370b424
 21 ad430b8e-f757-60d4-afa8-6504dd1712c7
 22 9bd36004-c921-34da-8b5d-92482c4cacd8
 23 6435b757-22a3-6a90-a283-21b25021b397
 24 66900b55-c423-478b-8f78-0896c0b1bbcc
 25 b07a8be6-0918-7d51-82eb-c68cc56244cd
 26 cd4f2184-6519-1af8-9f9d-5032f5497367
 27 aa8b987d-8149-13f0-811d-f07f3d5494fd
 28 2995157e-1d4b-4e50-a614-ba531178b5d7
 29 bc674da5-6383-6d6c-8632-ba4965e876a2
 30 f67866a0-af95-8231-99db-8e788ae40a43
 31 43a3ddec-ff67-3dbe-b8da-f9352e12c5c9
 32 51db6e69-bb57-3823-bb32-14142bf68ed2
 33 edc4fe4c-dd9c-7c07-b872-6569c8d50ae2
 34 8abd0341-2c41-8fd4-a01f-768f72e2150b
 35 851ceda5-0900-8080-b68f-6f3d490c1b66
 36 acd7db71-678f-25dc-aec6-fd62ce135dd9
 37 3fe33064-df68-2ccf-86ea-08cf6afb3433

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 0676000251464176712863647114683378822. Exactly this sequence comes out of new Random(797).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 53 of Run 27 (seed 1,337,299,625): new Random(1337299625), Next(8,64) per post. The RNG predicts N = 37; the post has N = 37 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:07–10:24).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs