Waraxe IT Security Portal

PorcaDio · Regular user

da08ed329f0: ÿ ÿ ÿ ÿ ³ÛÞ ÿ ÿ

Does anyone know what type of encryption this is?

ploert · Regular user

I don't know any algorythm that produces what you posted

It looks like 44 bit hash, which I never heared of.

The ÿ ÿ ÿ ÿ ³ÛÞ ÿ ÿ string makes even less sense, is that the output you get from putting the hash in some editor? Multiple ÿ's probably indicate your editor cannot display certain characters.

Are you sure this is the complete hash?

PorcaDio · Regular user

yes...I'm positive. It translates to "test6", but I'm not sure how/why. If you are honestly trying to help me out, I would just concentrate on "da08ed329f0:" being the encryption, because I think the rest is just fill in. I've tested with every method I can think of, but nothing seems to work.

ploert · Regular user

I was assuming it to be the first 11 characters of a hex, since

da08ed329f0 all characters are within 0-9 A-F

And if my assumption is right, the colon : is probably not part of the hash.
But since two characters in a hex string make one byte, the first or last byte wouldn't be complete.

I don't know of any hash that defaults to a 44 bit output (each hex character represents 4 bits)...

I've also tried comparing the MD5 and SHA1 of test6 to this string, but it doesn't seem to be a substring of any of those.

Afraid I can't help you with this one m8

PorcaDio · Regular user

well...if you are honestly trying to help out...I will be more direct. I am sending a string of code, through char variable called m_pSndBuffer. The first char is a cKey = char(4 Cool

, dwSize = 79. The string consists of: cKey, Player Name (Noob), Account Name (test1), Server Name, then this encrypted Account Password. Below is a seperate encryption code that is being used AFTER getting the encrypted Account Password. The encrypted Account Password is the last 32 bytes. The entire string being sent to this code below (to be further encrypted) is:

This example has a different account name/password which is: test1/asshole.

Buffer = char = int
m_pSndBuffer[0] = 0 = 48
m_pSndBuffer[1] = R = 82
m_pSndBuffer[2] = = 0
m_pSndBuffer[3] = = 4
m_pSndBuffer[4] = = 4
m_pSndBuffer[5] = = 8
m_pSndBuffer[6] = = 5
m_pSndBuffer[7] = = 0
m_pSndBuffer[8] = = 0
m_pSndBuffer[9] = N = 78
m_pSndBuffer[10] = o = 111
m_pSndBuffer[11] = o = 111
m_pSndBuffer[12] = b = 98
m_pSndBuffer[13] = = 0
m_pSndBuffer[14] = = 0
m_pSndBuffer[15] = = 0
m_pSndBuffer[16] = = 0
m_pSndBuffer[17] = = 0
m_pSndBuffer[18] = = 0
m_pSndBuffer[19] = t = 116
m_pSndBuffer[20] = e = 101
m_pSndBuffer[21] = s = 115
m_pSndBuffer[22] = t = 116
m_pSndBuffer[23] = 1 = 49
m_pSndBuffer[24] = = 0
m_pSndBuffer[25] = = 0
m_pSndBuffer[26] = = 0
m_pSndBuffer[27] = = 0
m_pSndBuffer[28] = = 0
m_pSndBuffer[29] = 7 = 55
m_pSndBuffer[30] = 8 = 56
m_pSndBuffer[31] = e = 101
m_pSndBuffer[32] = d = 100
m_pSndBuffer[33] = c = 99
m_pSndBuffer[34] = 1 = 49
m_pSndBuffer[35] = b = 98
m_pSndBuffer[36] = 6 = 54
m_pSndBuffer[37] = c = 99
m_pSndBuffer[38] = f = 102
m_pSndBuffer[39] = 4 = 52
m_pSndBuffer[40] = 2 = 50
m_pSndBuffer[41] = 0 = 48
m_pSndBuffer[42] = 0 = 48
m_pSndBuffer[43] = b = 98
m_pSndBuffer[44] = b = 98
m_pSndBuffer[45] = a = 97
m_pSndBuffer[46] = 0 = 48
m_pSndBuffer[47] = 3 = 51
m_pSndBuffer[48] = f = 102
m_pSndBuffer[49] = 7 = 55
m_pSndBuffer[50] = 7 = 55
m_pSndBuffer[51] = 6 = 54
m_pSndBuffer[52] = d = 100
m_pSndBuffer[53] = d = 100
m_pSndBuffer[54] = c = 99
m_pSndBuffer[55] = b = 98
m_pSndBuffer[56] = 1 = 49
m_pSndBuffer[57] = 8 = 56
m_pSndBuffer[58] = a = 97
m_pSndBuffer[59] = f = 102
m_pSndBuffer[60] = c = 99
m_pSndBuffer[61] = = 32
m_pSndBuffer[62] = = 32
m_pSndBuffer[63] = = 1
m_pSndBuffer[64] = = 1
m_pSndBuffer[65] = = 32
m_pSndBuffer[66] = = 32
m_pSndBuffer[67] = ) = 41
m_pSndBuffer[68] = ) = 41
m_pSndBuffer[69] = = 1
m_pSndBuffer[70] = = 32
m_pSndBuffer[71] = = 1
m_pSndBuffer[72] = = 32
m_pSndBuffer[73] = = 1
m_pSndBuffer[74] = = 1
m_pSndBuffer[75] = = 1
m_pSndBuffer[76] = = 32
m_pSndBuffer[77] = = 1
m_pSndBuffer[78] = = 1
m_pSndBuffer[79] = = 1
m_pSndBuffer[80] = = 32
m_pSndBuffer[81] = = 0

for (i = 0; i < (int)(dwSize); i++)
{
m_pSndBuffer[3+i] += (i ^ cKey);
m_pSndBuffer[3+i] = (char)( m_pSndBuffer[3+i] ^ (cKey ^ (dwSize - i)) );
}

ploert · Regular user

If you say the last 32 bytes form the password, then it would contain

- some hexadecimal characters following eachoter
- space-characters (32)
- 1 and 41

No hash produces something like that.

I think your password is from index 29-60, which are 32 bytes of hex characters

78edc1b6cf4200bba03f776ddcb18afc

Followed by either a server IP in some coding, or perhaps some flags.

MD5('asshole') doesn't get you that string though, perhaps another algorythm.

PorcaDio · Regular user

The password is index 49 to 81 (for sure). But yea...thanks for taking an interest in the problem. It must be some kind of "home made" encryption like the code I posted above.

ploert · Regular user

If so, then the last bytes are flags, possibly used in the calculation.

No encryption ever generates:
- one pair of space characters (32)
- one pair of 41
- one pair of ascii 1
- two groups of 3 ascii 1's

If you can, try other user/pass data and see what happens to bytes 61-81, perhaps the 1's turn in to 32's or 41's then.