Search code examples
encryptionreverse-engineering

Reverse engineer a string masking/obfuscating function


I would like to unmask or unobfuscate a piece of base64 encoded string containing some characters.

For instance, I know VovL5SaV_iSBx6oAFGypsTCO matches 00000000. Is there a way, knowing more data (the input and the output) to find out the algorithm that obfuscate the string? I couldn't find anything.

Some example:

  • The result of f(A) will vary in length if A is longer f(A) will be longer, if A is shorter f(A) will be shorter.
  • If we have A and B with a similar ending (e.g. aaaaa@gmail.com and bbbbb@gmail.com), then f(A) and f(B) will also have the same ending.

Solution

  • based on what you mentionned, it seems like the encryption uses a block cipher: One nive property about you block cipher is that the encryption of a block doesn't depend on the one before, this is not allways true, (and is very bad practice=very good for the you the attacker), one of block ciphers that does that is: ECB: https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Cipher_Block_Chaining_.28CBC.29 , as you can see the same key is used for each encryption, and the block cipher can be equivalent to a XOR allowing to guess decryopt anything. To check that trying f(00000000000000) where the length is more than one block and see if a pattern repeats it self. If this not the case, you might be useing something like CTR: https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Counter_.28CTR.29 here a "key(i)"=blockcipher(key,nonce(i)) is used to encrypted each block using XOR, if you manage to calculate again f(000000000000) and find key(1), key(2)... you can use them latter to decrypt anything you want. if you can provide me with the tool used for the obfuscation I might be able to decrypt what you want