Skip to content

Commit

Permalink
add link and fix typo
Browse files Browse the repository at this point in the history
  • Loading branch information
gogo2464 committed Oct 20, 2024
1 parent 8797c84 commit e17313b
Show file tree
Hide file tree
Showing 3 changed files with 11 additions and 9 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,8 @@ draft: false

## I - Identify

In a previous [article](https://gogo2464.github.io/gogo-s-blog-cpe/from-0-to-buffer-overflow-by-projects/episode-2-guessing-source-code-reverse-engineering-program/), I read the source code of a program from the executable. The goal of this new article is to audit the logic behind the math algorithm that supposed to avoid to make someone reverse the modification of the password. The password modification algorithm provided by the previous article work is available at this [url](https://codeberg.org/gogo/viegenere-cisco-proprietary-algorythm-decompiled-from-packet-tracer).

According to the documentation and as it is mentionned that type 7 is an hashing algorithm.

A secure hash algorithm is an hash algorithm so that for any function hash that transform the original (plaintext) value $ hased = H(plain) $ there does not exist a function $ rev(hashed) $ so that $ rev(hashed) = plain $.
Expand Down
Binary file not shown.
Original file line number Diff line number Diff line change
Expand Up @@ -27,8 +27,7 @@
((p_i \oplus hp_{8 + i}) \land 0xf) + 0x30, & \text{if } (h_{i} \oplus hp_{i+8} \land 0xf < 0x0a) \text{ and if } i \equiv 1 \pmod 2 \\
((p_i \oplus hp_{8 + i}) \land 0xf) + 0x37, & \text{if } (h_{i} \oplus hp_{i+8} \land 0xf \geq 0x0a) \text{ and if } i \equiv 1 \pmod 2
\end{cases} \\
) \implies \nexists p[p = \mathbf{rev}(h)] \\
) \implies \nexists p[p = \mathbf{rev}(h)]
\]
\end{multline}
\end{flushleft}
Expand Down Expand Up @@ -85,9 +84,9 @@

In the previous chapter one `I/ substraction to reverse the addition`, we told we can reverse the previous addition. We still need to guess which addition/substraction has been done previously.

As both addition values are made depending of: \\
if $ (password_left & 0xf0 < 0xa0) \implies (password_left & 0xf0 + 0x30) $ or else $ (password_left & 0xf0 > 0xa0) \implies (password_left & 0xf0 + 0x37) \\ $
if $ (password_right & 0x0f < 0x0a) \implies (password_right & 0x0f + 0x30)$ or else $ (password_right & 0x0f > 0xa0) \implies (password_right & 0x0f + 0x37) \\ $
As both addition values are made depending to: \\
if $ (p_l \land 0xf0 < 0xa0) \implies (p_l \land 0xf0 + 0x30) $ or else $ (p_l \land 0xf0 > 0xa0) \implies (p_l \land 0xf0 + 0x37) \\ $ \\
if $ (p_r \land 0x0f < 0x0a) \implies (p_r \land 0x0f + 0x30)$ or else $ (p_r \land 0x0f > 0xa0) \implies (p_r \land 0x0f + 0x37) \\ $

So if the out has the 4 four bits value so that:
$ x \in { x | (0xf0 & x) \leq 0xa0 } \implies y = x + 0x30 $ $\\$
Expand All @@ -102,30 +101,31 @@
$ x \in { x | (0x0f & x) > 0x0a } \implies y = x + 0x37 $ $\\$

first byte: \\
$ 0xa0 < 0xf0 + 0x30 < y \\ $
then:\\
as $ 0xa0 < 0xf0 + 0x30 < y \\ $
-1: $ \forall y \in H(x), x \in { x | 0xa0 < x } \implies [y \in { y | 0x00 < y < 0xa7 }] \\$
-2: $ \forall y \in H(x), x \in { x | x < 0xa0 } \implies [y \in { y | 0xc0 < y }] \\$

second byte:
$ 0xa0 < 0x0f + 0x30 < y \\ $
as $ 0xa0 < 0x0f + 0x30 < y \\ $
-1: $ \forall y \in H(x), x \in { x | x < 0x0a } \implies [y \in { y | 0x3a < y }] \\$
-2: $ \forall y \in H(x), x \in { x | 0x0a < x } \implies [y \in { y | y < 0x4a }] \\$


Then for both of any subnumber:

$ \forall y = H(x), x \in { x | x \leq 0xa } \implies y = x + 0x30 $ $\\$

$ \forall y = H(x), x \in { x | x > 0xa } \implies y = x + 0x37 $ $\\$

It follows:

$ \forall y = H(x), y \in { y | 0 < y \leq 0x0a + 0x30 } \implies x = y - 0x30 $ then $ 0 < x < 0x0a $ $\\$

$ \forall y = H(x), y \in { y | 0 < y \leq 0x0a + 0x37 } \implies x = y - 0x30 $ then $ 0x0a \leq x $ $\\$

# V /communtativity:

Addition, substraction and $ \oplus $ are commutative. \\
Addition, substraction and $ \oplus $ are commutative. $ \\ $

# VI / proof

Expand Down

0 comments on commit e17313b

Please sign in to comment.