A858DE45F56D9BC9 archive

201209091500 zlbup

explained decrypted filler

seed 2

Metadata

Post ID
zlbup
Title
201209091500 → 2012-09-09 15:00 on A858's clock
Posted (UTC)
2012-09-09 06:00:05
Timezone
UTC+9 · title 15:00 against posted 06:00 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,616 hex characters · 808 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201209091500) = 740c3d5228f2cee94f4300c844d8d6d3 (name+title)
GUIDs
25
Filler GUID seed
new Random(2).Next(9) ✓ verified
Run
Run 31 (seed 15,917,281) (seed)
Draw
12 · predicted N = 25 ✓
Machine boot
2012-09-07 23:34–00:34 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
5 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

DF91123BA1D8459C E1FB7A54EAEA58F3 CCFE029BC255F9FB B7767086AD26569B 57344F0A29FB950F 66D349173FABBDBA F13E6C5ECCE0A0E2 58E8512773F051DC 66CCFE6C855A5BFC 5E1B291E3C8EDD27 C4EC2B71528CE2C7 0DD95C7521B291D6 A56F11CDA7EABEDC CB42B2468522CBC5 A71398BFADDA9536 3DA25208CD5C45B9 C9C0C06506DEAE58 91C78DF5D2EC0E20 666290B002B652BD 9FCA0ABBA2CCA63B 559D18558D97FB95 169F60A97AC158DB D6AF16344A40A954 6F01DD0ADACD9879 2703F72547269C8D 4AA499ACC2669FEA 97062F8A096F4317 9A4A0442F346FBDD 8B6BDB7EB7525AEA 1198FF6F7C577FB3 7225E9935B7B050B C89DFA6A05B5CB39 7EAF9FCA3BD2EBF8 26C56739AB18E42F 82FEC91563E1B33F 4407A3E4611238B2 4C6839A9255C7557 552DE8A59137ECA1 8CB59021589370FC 860824D60DAA2BC2 862C38E8E6F78452 7FCD4473A63A4187 2157AF296DA1C0DB 85C7585273DA52F6 A972EED344F73D63 5983D888E2200ED1 498630C52B20FD07 B7B232B62DE00459 0BA2305F83F0B764 7FAEE2674457484F C0D233FDE1001EEC 7EB76BB76EF3733B EDE6BCE0B20F31E0 0FC7C7CBABCD356E 56EC0DFC5CD5FAE8 FF4568EEB9F8B4AA B1B075148FF720CD 03D5814860B1870B 01FE1E50439E786B 6253127D145B75B9 99DFA995BA0DD791 96389F55E47887F4 786CC2BA4BD973B5 A41C242FE3DF62A2 6205368A063EDEEC A54EC0069802CEBD DFACD23F6E5CAE37 207BB995B6029F50 C6B5D0CA63BDF702 2C68D1EDE7FCAA55 8E6F0F1329F4C0D0 ED17D531730058A3 19312A4D658582B9 B37EF1706719D3D7 34748F17EA928A52 AF58B4891A6BB73C 59A38157DD7ED589 D71DF78BEE4F0D27 FA99B616EEF1F6B4 89210524A7E3222A 10455C6CD204F582 0DA77E582AFAFB2E 388BDF9F714D7A84 0D90F69A824436B6 FDA7602490E438A8 304029C0D187B9FE 027AFD79D0A77539 17D035B71B297253 3576F2A0BEAF62E9 3E628B523863F373 7A54556E14EE960C 3C3881F5909CAEA5 BDA583FE79789A19 4F929BC3E433EFC3 8C372327ADF95A8F 95A7C3A22CB33B18 7D553CB6FB257CBE DAF8C5DCCE9843D5 A0F6CA195DC9238B 9FC6BD06C5D29591 D97FC553C78EF0BD
  • Read the ciphertext. Strip whitespace: 1,616 hex characters = 808 bytes = 101 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201209091500 (name+title). Key = MD5(password) = 740c3d5228f2cee94f4300c844d8d6d3, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 25 GUIDs as hex (shown below).

Decrypted: GUID list

  1 f7778531-9cf1-69b6-8bd8-389c5382de3c
  2 3b37989b-091e-36d7-b04f-af935e1ef825
  3 ee41ef75-0c5c-13f3-8f1b-021a96d8f95e
  4 7fa5f396-33f7-8a73-ae3c-6382dcace97f
  5 16f2495e-77fd-0d6c-b00c-61006ebefb84
  6 fbdd61ce-2d62-2b19-81cf-5e27bc1a1862
  7 5324aca2-be03-764b-992a-202e3e96a181
  8 7ec83206-9a7b-4e02-9376-9218821c7bfe
  9 b29fd6e3-4d86-2202-bf4f-cd8a8abcd1f5
 10 48276b6a-08a1-0e65-a271-8c8a54905014
 11 862755d6-204e-61c9-aa0c-fae8581fbfc1
 12 1da05f70-5b61-0daf-bf6f-b3e0defda265
 13 b1c4a1d9-7528-042c-a7a0-df1fdc76a3e1
 14 28b237cf-c281-44bd-815c-73e98f011d6d
 15 d73d7424-5a43-3061-a2a5-8924beb5bfde
 16 07e31832-cd39-2c55-a858-5ef3d62aa069
 17 39632b96-ba87-60b9-9abb-fd5bc084c320
 18 16f1b635-abea-2e4b-b7da-995ed58aa31a
 19 a916178d-ae2e-60dd-99c5-7d2bd88a5baa
 20 b1307b26-e30f-04af-92e6-e86047652479
 21 936cbf88-9053-0399-95de-e981e5e32f8b
 22 c6711471-5e75-39bd-8d23-7dbb032e3d16
 23 82f78316-852a-2f46-9ba8-0d765fec841a
 24 84a5fefc-18e2-62bd-84f0-f3e3ff866eb7
 25 f2beb183-54dc-8ee5-822f-a75fd33edf03

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 6318027420600432626003268. Exactly this sequence comes out of new Random(2).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 12 of Run 31 (seed 15,917,281): new Random(15917281), Next(8,64) per post. The RNG predicts N = 25; the post has N = 25 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-07 23:34–00:34).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs