Skip to content

Instantly share code, notes, and snippets.

@aimardcr

aimardcr/dump_2nd_bind.py

Created July 30, 2023 16:03
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save aimardcr/b23c21a1a8133e9f1e21ae2091b05614 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save aimardcr/b23c21a1a8133e9f1e21ae2091b05614 to your computer and use it in GitHub Desktop.
Download ZIP
Gemastik 2023 - FCaaS (Rev)
Raw
dump_2nd_bind.py
def rc4(key, data):
S = list(range(256))
j = 0
for i in range(256):
j = (j + S[i] + key[i % len(key)]) % 256
S[i], S[j] = S[j], S[i]
i = j = 0
result = []
for byte in data:
i = (i + 1) % 256
j = (j + S[i]) % 256
S[i], S[j] = S[j], S[i]
t = (S[i] + S[j]) % 256
result.append(byte ^ S[t])
return bytes(result)
s_box1 = [0] * 47
s_box2 = [0] * 47
key1 = [0] * 47
s_box3 = [0] * 47
s_box4 = [0] * 47
key2 = [0] * 47
s_box1[0] = 0x1D89
s_box1[1] = 0x245D
s_box1[2] = 0x2E2D
s_box1[3] = 0x17AB
s_box1[4] = 0x2949
s_box1[5] = 0x2361
s_box1[6] = 0x340D
s_box1[7] = 0x284D
s_box1[8] = 0x1B95
s_box1[9] = 0x2751
s_box1[0xA] = 0x1F7B
s_box1[0xB] = 0x311D
s_box1[0xC] = 0x2F29
s_box1[0xD] = 0x2559
s_box1[0xE] = 0x36F9
s_box1[0xF] = 0x3EC9
s_box1[0x10] = 0x3DCF
s_box1[0x11] = 0x3AE1
s_box1[0x12] = 0x3CD3
s_box1[0x13] = 0x2D35
s_box1[0x14] = 0x13C1
s_box1[0x15] = 0x3215
s_box1[0x16] = 0x3311
s_box1[0x17] = 0x15B5
s_box1[0x18] = 0x2073
s_box1[0x19] = 0x1E81
s_box1[0x1A] = 0x1C8F
s_box1[0x1B] = 0x2A41
s_box1[0x1C] = 0x216B
s_box1[0x1D] = 0x2B3B
s_box1[0x1E] = 0x35FD
s_box1[0x1F] = 0x38ED
s_box1[0x20] = 0x2657
s_box1[0x21] = 0x3505
s_box1[0x22] = 0x37F3
s_box1[0x23] = 0x18A7
s_box1[0x24] = 0x3025
s_box1[0x25] = 0x3BDB
s_box1[0x26] = 0x2C39
s_box1[0x27] = 0x2267
s_box1[0x28] = 0x1A9D
s_box1[0x29] = 0x14B9
s_box1[0x2A] = 0x19A1
s_box1[0x2B] = 0x3FC5
s_box1[0x2C] = 0x16B1
s_box1[0x2D] = 0x12C9
s_box1[0x2E] = 0x39E7
s_box2[0] = 0xB
s_box2[1] = 0x12
s_box2[2] = 0x1C
s_box2[3] = 5
s_box2[4] = 0x17
s_box2[5] = 0x11
s_box2[6] = 0x22
s_box2[7] = 0x16
s_box2[8] = 9
s_box2[9] = 0x15
s_box2[0xA] = 0xD
s_box2[0xB] = 0x1F
s_box2[0xC] = 0x1D
s_box2[0xD] = 0x13
s_box2[0xE] = 0x25
s_box2[0xF] = 0x2D
s_box2[0x10] = 0x2C
s_box2[0x11] = 0x29
s_box2[0x12] = 0x2B
s_box2[0x13] = 0x1B
s_box2[0x14] = 1
s_box2[0x15] = 0x20
s_box2[0x16] = 0x21
s_box2[0x17] = 3
s_box2[0x18] = 0xE
s_box2[0x19] = 0xC
s_box2[0x1A] = 0xA
s_box2[0x1B] = 0x18
s_box2[0x1C] = 0xF
s_box2[0x1D] = 0x19
s_box2[0x1E] = 0x24
s_box2[0x1F] = 0x27
s_box2[0x20] = 0x14
s_box2[0x21] = 0x23
s_box2[0x22] = 0x26
s_box2[0x23] = 6
s_box2[0x24] = 0x1E
s_box2[0x25] = 0x2A
s_box2[0x26] = 0x1A
s_box2[0x27] = 0x10
s_box2[0x28] = 8
s_box2[0x29] = 2
s_box2[0x2A] = 7
s_box2[0x2B] = 0x2E
s_box2[0x2C] = 4
s_box2[0x2D] = 0
s_box2[46] = 0x28
key1[0] = 0xA5
key1[1] = 0xE8
key1[2] = 0xE9
key1[3] = 1
key1[4] = 0xC2
key1[5] = 0x2F
key1[6] = 0xAA
key1[7] = 0x47
key1[8] = 0x81
key1[9] = 0xB6
key1[0xA] = 0x6B
key1[0xB] = 0x82
key1[0xC] = 0xDB
key1[0xD] = 0xC
key1[0xE] = 0x47
key1[0xF] = 0xE0
key1[0x10] = 0x36
key1[0x11] = 0xAC
key1[0x12] = 0xBC
key1[0x13] = 0x8A
key1[0x14] = 7
key1[0x15] = 0x7B
key1[0x16] = 0x6F
key1[0x17] = 0xBB
key1[0x18] = 0x2D
key1[0x19] = 0xB6
key1[0x1A] = 0x85
key1[0x1B] = 0x40
key1[0x1C] = 0x57
key1[0x1D] = 0x73
key1[0x1E] = 0xE3
key1[0x1F] = 0x13
key1[0x20] = 0xD0
key1[0x21] = 0xBC
key1[0x22] = 0x46
key1[0x23] = 0x97
key1[0x24] = 0x3A
key1[0x25] = 0xFE
key1[0x26] = 0x72
key1[0x27] = 0x1F
key1[0x28] = 0xBD
key1[0x29] = 0x7D
key1[0x2A] = 0x89
key1[0x2B] = 0x9D
key1[0x2C] = 0xEA
key1[0x2D] = 0x1A
key1[0x2E] = 0xC5
s_box3[0] = 0x132E
s_box3[1] = 0x1426
s_box3[2] = 0x151E
s_box3[3] = 0x161C
s_box3[4] = 0x1716
s_box3[5] = 0x1810
s_box3[6] = 0x190C
s_box3[7] = 0x1A08
s_box3[8] = 0x1B02
s_box3[9] = 0x1BFA
s_box3[0xA] = 0x1CF4
s_box3[0xB] = 0x1DEE
s_box3[0xC] = 0x1EE6
s_box3[0xD] = 0x1FE0
s_box3[0xE] = 0x20D8
s_box3[0xF] = 0x21D0
s_box3[0x10] = 0x22CC
s_box3[0x11] = 0x23C8
s_box3[0x12] = 0x24C4
s_box3[0x13] = 0x25BE
s_box3[0x14] = 0x26BE
s_box3[0x15] = 0x27B6
s_box3[0x16] = 0x28B2
s_box3[0x17] = 0x29AE
s_box3[0x18] = 0x2AA6
s_box3[0x19] = 0x2BA2
s_box3[0x1A] = 0x2CA0
s_box3[0x1B] = 0x2D9A
s_box3[0x1C] = 0x2E92
s_box3[0x1D] = 0x2F8E
s_box3[0x1E] = 0x308A
s_box3[0x1F] = 0x3182
s_box3[0x20] = 0x327A
s_box3[0x21] = 0x336B
s_box3[0x22] = 0x3472
s_box3[0x23] = 0x356A
s_box3[0x24] = 0x3662
s_box3[0x25] = 0x375E
s_box3[0x26] = 0x3858
s_box3[0x27] = 0x3954
s_box3[0x28] = 0x3A4E
s_box3[0x29] = 0x3B46
s_box3[0x2A] = 0x3C40
s_box3[0x2B] = 0x3D38
s_box3[0x2C] = 0x3E34
s_box3[0x2D] = 0x3F30
s_box3[46] = 0x402C
s_box4[0] = 0x25
s_box4[1] = 0x22
s_box4[2] = 0x2B
s_box4[3] = 0x2E
s_box4[4] = 0x29
s_box4[5] = 0x12
s_box4[6] = 0x2C
s_box4[7] = 0x2A
s_box4[8] = 0x2D
s_box4[9] = 0x16
s_box4[0xA] = 0x13
s_box4[0xB] = 0x1F
s_box4[0xC] = 7
s_box4[0xD] = 9
s_box4[0xE] = 0x1B
s_box4[0xF] = 0x28
s_box4[0x10] = 0
s_box4[0x11] = 0x11
s_box4[0x12] = 1
s_box4[0x13] = 6
s_box4[0x14] = 0x20
s_box4[0x15] = 0x14
s_box4[0x16] = 0x26
s_box4[0x17] = 0x17
s_box4[0x18] = 4
s_box4[0x19] = 0x1D
s_box4[0x1A] = 2
s_box4[0x1B] = 0xE
s_box4[0x1C] = 0x24
s_box4[0x1D] = 0xD
s_box4[0x1E] = 0xC
s_box4[0x1F] = 0x27
s_box4[0x20] = 0x18
s_box4[0x21] = 8
s_box4[0x22] = 0x19
s_box4[0x23] = 3
s_box4[0x24] = 0x1A
s_box4[0x25] = 0x15
s_box4[0x26] = 5
s_box4[0x27] = 0x23
s_box4[0x28] = 0x10
s_box4[0x29] = 0xF
s_box4[0x2A] = 0xB
s_box4[0x2B] = 0x21
s_box4[0x2C] = 0x1E
s_box4[0x2D] = 0xA
s_box4[46] = 0x1C
key2[0] = 0x79
key2[1] = 0xFF
key2[2] = 0xC7
key2[3] = 0x99
key2[4] = 0x4D
key2[5] = 0x8F
key2[6] = 0x14
key2[7] = 0xC
key2[8] = 0x2F
key2[9] = 0x3F
key2[0xA] = 0x2F
key2[0xB] = 0x6F
key2[0xC] = 0x95
key2[0xD] = 0xE5
key2[0xE] = 0xE0
key2[0xF] = 0xD3
key2[0x10] = 0x8C
key2[0x11] = 0x5C
key2[0x12] = 0xFC
key2[0x13] = 0x7C
key2[0x14] = 0xC8
key2[0x15] = 0x21
key2[0x16] = 0x74
key2[0x17] = 0x76
key2[0x18] = 0x19
key2[0x19] = 0xEA
key2[0x1A] = 0x3B
key2[0x1B] = 7
key2[0x1C] = 0x21
key2[0x1D] = 0xC1
key2[0x1E] = 0x97
key2[0x1F] = 0x46
key2[0x20] = 0xF2
key2[0x21] = 0xB3
key2[0x22] = 0xFF
key2[0x23] = 0xF4
key2[0x24] = 0xCC
key2[0x25] = 0x27
key2[0x26] = 0xA3
key2[0x27] = 0xE0
key2[0x28] = 0x7E
key2[0x29] = 0x75
key2[0x2A] = 0xD8
key2[0x2B] = 0x46
key2[0x2C] = 0xF9
key2[0x2D] = 0xD5
key2[0x2E] = 0x4C
inp = 'gemastik{'
inp += 'a' * (47 - len(inp) - 1)
inp += '}'
with open('encrypted_bin', 'rb') as f:
data = bytearray(f.read())
for i in range(0, 0x2F):
data[s_box1[i]] = key1[i] ^ ord(inp[s_box2[i]])
data[s_box3[i]] = key2[i] ^ ord(inp[s_box4[i]])
with open('second_binary', 'wb') as f:
f.write(rc4(b'gemastik2023', data))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment