So, there is a PLC and a SoftMaster program to work with it. The PLC works according to the XGFenet protocol. When connecting to the PLC for the first time in SoftMaster, a password must be entered. And I caught this whole process using Wireshark.
At the very beginning, we send a message like this to the PLC:
where 41 44 is a request for a specific session key.
With the next package we get:
The PLC sent us a set of bytes. It is these bytes that are causing this question. More details further.
We enter the password qwerty and it will be converted to
Obviously, the bytes sent in the second packet encrypted our password in this form. And after that we get correct password
Question: how did the bytes sent in the second packet encrypt our password to this form?
I experimented and wrote a script to request this session key multiple times. All the bytes sent differed by about 1000 units, respectively, something like a time or a countdown is sent to us and the password is encrypted based on it.
If you do not know the answer, advise what other experiments can be done to understand what it is or in what direction to study. Thank you.
UPD
The password length is limited by SoftMaster and you cannot enter more than 8 characters. But, even if the password consists of one character, the encrypted password does not differ in length from eight characters. Similar to hashing.
Here are some examples:
Password A
Password AA
Password AAA
And here is the same password qwerty entered with a difference of a couple of seconds
But there is nothing strange here. Before each entry, a new session key is requested and these two identical passwords are encrypted with different keys.
Using ProcessMonitor, I checked the services that are called during password entry and validation. Maybe there's a hint here
