Subject: Re: Commit: Password dialog
From: Aaron Lehmann (aaronl@vitelus.com)
Date: Wed Oct 17 2001 - 23:11:44 CDT
On Wed, Oct 17, 2001 at 03:16:33PM -0400, Dom Lachowicz wrote:
> easy to crack because of the simple XOR scheme used, but since cracking that
> password automatically would probably be a violation of the DMCA or some other
HAHAHA. Afraid of the DMCA?
int
wvCrack95 (wvParseStruct * ps)
{
/*
is is quite possible to crack password 95 files fairly easily,
there is standard frequency analysis on the cipher text whiich
is simply stamped with a 16byte xor key from 0x28 onwards,
but there are quite a few known bytes in the fib header with
is also encrypted, for instance unencrypted is the beginning
and end of the text stream, encrypted is the len of the
text stream, so already you have a few bytes of the xor key,
and so on, the fcStshOrig is nearly always the same as the fcStsh
so theres another byte or two, and so forth. If a struct has
an lcb of 0, it remains zero despite what should happen in a
xor and thus you know that the fc before and after the 0 lcb
are the same, and so forth, so you could derive a lot of
information about the xor key from the header, I might
complete this some day, there have been a load of other programs
that do similiar things, so i don't know that my adding to that
pile will help
*/
int i;
U8 block1[4];
U8 block2[4];
U32 reallen;
wvError (("begin is %x\n", ps->fib.fcMin));
wvError (("end is %x\n", ps->fib.fcMac));
wvError (("len is %x\n", ps->fib.fcMac - ps->fib.fcMin));
reallen = ps->fib.fcMac - ps->fib.fcMin;
wvError (("encrypted len is %x\n", ps->fib.ccpText));
block1[0] = (U8) (ps->fib.ccpText & 0xFF);
block1[1] = (U8) ((ps->fib.ccpText >> 8) & 0xFF);
block1[2] = (U8) ((ps->fib.ccpText >> 16) & 0xFF);
block1[3] = (U8) ((ps->fib.ccpText >> 24) & 0xFF);
block2[0] = (U8) (reallen & 0xFF);
block2[1] = (U8) ((reallen >> 8) & 0xFF);
block2[2] = (U8) ((reallen >> 16) & 0xFF);
block2[3] = (U8) ((reallen >> 24) & 0xFF);
key[4] = block1[0] ^ block2[0];
key[5] = block1[1] ^ block2[1];
key[6] = block1[2] ^ block2[2];
key[7] = block1[3] ^ block2[3];
block1[0] = (U8) (ps->fib.lcbStshf & 0xFF);
block1[1] = (U8) ((ps->fib.lcbStshf >> 8) & 0xFF);
block1[2] = (U8) ((ps->fib.lcbStshf >> 16) & 0xFF);
block1[3] = (U8) ((ps->fib.lcbStshf >> 24) & 0xFF);
block2[0] = block1[0] ^ key[4];
block2[1] = block1[1] ^ key[5];
ck2[2] = block1[2] ^ key[6];
block2[3] = block1[3] ^ key[7];
reallen = sread_32ubit (block2);
fprintf (stderr, "reallen is %x\n", reallen);
block2[0] = (U8) (reallen & 0xFF);
block2[1] = (U8) ((reallen >> 8) & 0xFF);
block2[2] = (U8) ((reallen >> 16) & 0xFF);
block2[3] = (U8) ((reallen >> 24) & 0xFF);
block1[0] = (U8) (ps->fib.lcbStshfOrig & 0xFF);
block1[1] = (U8) ((ps->fib.lcbStshfOrig >> 8) & 0xFF);
block1[2] = (U8) ((ps->fib.lcbStshfOrig >> 16) & 0xFF);
block1[3] = (U8) ((ps->fib.lcbStshfOrig >> 24) & 0xFF);
key[12] = block1[0] ^ block2[0];
key[13] = block1[1] ^ block2[1];
key[14] = block1[2] ^ block2[2];
key[15] = block1[3] ^ block2[3];
block1[0] = (U8) (ps->fib.fcStshf & 0xFF);
block1[1] = (U8) ((ps->fib.fcStshf >> 8) & 0xFF);
block1[2] = (U8) ((ps->fib.fcStshf >> 16) & 0xFF);
block1[3] = (U8) ((ps->fib.fcStshf >> 24) & 0xFF);
block2[0] = (U8) (ps->fib.fcPlcffndRef & 0xFF);
block2[1] = (U8) ((ps->fib.fcPlcffndRef >> 8) & 0xFF);
block2[2] = (U8) ((ps->fib.fcPlcffndRef >> 16) & 0xFF);
block2[3] = (U8) ((ps->fib.fcPlcffndRef >> 24) & 0xFF);
if ((block1[0] == 0) && (block2[0]) && (reallen < 0xff))
{
fprintf (stderr, "good\n");
key[8] = reallen ^ block2[0];
}
else
fprintf (stderr, "crap\n");
block2[0] = (U8) (ps->fib.lcbPlcffndRef & 0xFF);
block2[1] = (U8) ((ps->fib.lcbPlcffndRef >> 8) & 0xFF);
block2[2] = (U8) ((ps->fib.lcbPlcffndRef >> 16) & 0xFF);
block2[3] = (U8) ((ps->fib.lcbPlcffndRef >> 24) & 0xFF);
fprintf (stderr, "%x %x %x %x\n", block2[0], block2[1], block2[1],
block2[0]);
if ((block2[0] == 0) && (block2[1] == 0) && (block2[2] == 0)
&& (block2[3] == 0))
{
fprintf (stderr, "good\n");
block1[0] = (U8) (ps->fib.fcPlcffndRef & 0xFF);
block2[0] = (U8) (ps->fib.fcPlcffndTxt & 0xFF);
reallen = key[8] ^ block2[0];
key[0] = reallen ^ block1[0];
}
for (i = 0; i < 16; i++)
fprintf (stderr, "key %d is %x\n", i, key[i]);
return (0);
}
/me watches that code mysteriously disappear from libwv.
This archive was generated by hypermail 2b25 : Wed Oct 17 2001 - 23:12:01 CDT