# Seed/Key Constant Value

I am trying to reverse a seed/key algorithm that has a constant value inside it. and there is different const value for different device that use this algorithm. i can give some sample from each device so i have seed/key of devices. the algorithm is :

``````int SeedKey_Algorithm(int seed){ // sample input: 0x01010101
for (int i = 0; i < 0x23; i++)
{
if ((seed & 0x80000000) == 0x80000000)
{
seed = ( x ^ seed); // x is constant value
}
seed = seed << 1;
}
return seed;
//out = 0xFFAA5550
}
``````

then if when inject the 0x01010101 as input we get 0xFFAA5550 as output. so how i can find this constant value. is there any mathematics algorithm for find it? is it needed more sample for reverse this?

UPDATE
so i check another device that work with this algorithm and i find 12 true value for 0x01010101.
```0x0d7c76ff, 0x1049164d, 0x37749eba, 0x6071e476, 0x6cced1e7, 0x7657a4aa, 0x8d7c76ff, 0x9049164d, 0xb7749eba, 0xe071e476, 0xecced1e7, 0xf657a4aa```

but for 0x02020202 i can't find any right value :(
is this possible? or I made a mistake?

The keyspace for x is only `2**32`. This can be easily bruteforced. Also you can use something like z3 a SAT solver to model the equations. For your given pair these were the possible 16 values for x

``````0x153f11fa, 0x953f11fa
0x24c66e44, 0xa4c66e44
0x3bcc14c8, 0xbbcc14c8
0x3c2918cb, 0xbc2918cb
0x477bb478, 0xc77bb478
0x662a1eac, 0xe62a1eac
0x71539c35, 0xf1539c35
0x76a55966, 0xf6a55966
``````

With an additional keypair the candidates can be boiled down to 2 values

``````xxxxxxxxxx:::0x01010101:0x02020202:0x03030303:0x08010101
0x3bcc14c8:::0xffaa5550:0x88cc8330:0x7766d660:0x87a95f90
0xbbcc14c8:::0xffaa5550:0x88cc8330:0x7766d660:0x87a95f90
``````

Both of these can be used interchangeably as the 31st bit is inconclusive.

• thanks @sudhacker, so i need more sample to achieve unique answer. is this ture? Feb 15, 2020 at 10:13
• Can you provide additional samples? Feb 15, 2020 at 10:31
• absolutely yes. Feb 15, 2020 at 10:38
• Please add as many as possible pairs you can. Feb 15, 2020 at 10:46
• o0o0om. . .I didn't understand what you mean. but i have some sample for new device that worked with this algorithm but different counter or different constant value. for example: 0x01010101 ==> 0xDFBB4565 and 0x02020202 ==> 0x21028781 and 0x02010101 ==> 0xB1C7ED2B and 0x08010101 ==> 0xFB9718DE Feb 15, 2020 at 11:33