## pCTF 2013 ## cone 250 ## mak - DragonSector #!/usr/bin/env python2 from struct import pack def hash_old(inp): return (0xdeadbeef + (0xdeadbeef ^ ( ((inp << 0x15)&0xffffffff) | ((inp >> 0x15) & 0xfff))))&0xffffffff def hash_new(inp): return (0xdeadbeef + (0xdeadbeef ^ ( ((inp << 0x0b)) | ((inp >> 0x15) & 0x3ff))))&0xffffffff def dehash_old(inp): make_num = lambda l,h,b: l | h | (b << 12) inp2 = ((inp - 0xdeadbeef) ^ 0xdeadbeef) high = (inp2 & 0xfff) << 0x15 low = (inp2 & 0xfffff000) >> 0x15 b = [ b for b in range(21,0xff) if hash_old(make_num(low,high,b)) == inp][0] return make_num(low,high,b) def dehash_new(inp): make_num = lambda l,h,b: (l | h) + b inp2 = ((inp - 0xdeadbeef) ^ 0xdeadbeef) high = ((inp2 & 0x3ff) << 0x15) & 0xfffffffff low = (inp2 & 0xfffff000) >> 0xb # print hex(inp2); print hex(high); print hex(low) b = [ b for b in range(0,2) if hash_new(make_num(low,high,b)) == inp][0] return make_num(low,high,b) # subkeys2 = [1600214128L, 1684100467L, 1818316895L, 1835095920, 1600213343, 1952536417, 1600213857, 1751208301, 6379113] # (1600214128, 1684100467, 1818316895, 1835095920, 1600213343, 1952536417, 1600213857, 1751208301, 174151273) subkeys_old = [0x2F5B7B03,0x4F7B7CBB,0xB3FB7C7B,0xF5B7C73,0xD3FB7B03,0x113B7C3B,0x913B7B03,0xD1BB7C9B,0x0F23B7DDB] subkeys = [0x247BFB03,0x8C33E4BB,0xD49D047B,0x7303FC73,0x8C950303,0x2304743B,0x64647303,0xA454949B,0xD48CB5DB] print "old:" print len(subkeys_old) print ''.join(map(lambda x: pack('i',dehash_old(x)),subkeys_old)) # - print "new:" print len(subkeys) print ''.join(map(lambda x: pack('i',dehash_new(x)),subkeys))