The way you can learn this encoding is to study Japanese. :) From the first line of your text file diff, we can see that this on the left:
1131 3210 3130 3330 1021 0000 0000 0000 .12.1030.!......
Translates to this on the right:
1100 3100 3200 1000 3100 3000 3300 3000 ..1.2....184.108.40.206.
1000 01ff 0000 0000 0000 0000 0000 0000 .................
TL;DR: What we have here is probably not an encryption algorithm, it is more likely a decompression loop, by the look of it. It simply does not do anything that could be considered even remotely similar to encryption.
Encryption algorithms are divided into two classes. First is a stream cipher. From wikipedia:
A stream cipher is a symmetric key cipher where ...
From the Wikipedia article to which you linked:
A binary file is a computer file that is not a text file; it may
contain any type of data, encoded in binary form for computer storage
and processing purposes.
That's what you're seeing in your screenshot above, but the hex editor you're using is displaying binary data (0s and 1s) in hexadecimal form to ...
You can try to use binwalk. It can be used in various ways:
Embedded file identification and extraction
Executable code identification
Entropy analysis and graphing (useful for compression and encryption identification)
"Smart" strings analysis
You could also try to open your file with 7zip, since it supports a shitload of compression formats.
This is not yet a complete answer, but perhaps what I've found can be combined with other information to come up with the complete solution.
First name encoding
If we assume a linear encoding, then we have everything needed to figure this out based on your four samples. If we consider letter values as a=0, b=1, ... regardless of whether they're uppercase ...
^^ ^ ^ ^^^^
|| Addr Data CRC16
` Data tag
D for data
L20 for 0x20 or 32 hex bytes, or 64 hex digits
I000000 the address (note ...
It seems you're new to Hex. You can think of Hex as a compact form for binary. The following table might help you:
0 hex is 0000 binary
1 hex is 0001 binary
2 hex is 0010 binary
3 hex is 0011 binary
4 hex is 0100 binary
5 hex is 0101 binary
6 hex is 0110 binary
7 hex is 0111 binary
8 hex is 1000 binary
9 hex is 1001 binary
a hex is 1010 binary
b hex is 1011 ...
Edit: The encryption is Bitwise XOR with the key 0x04 (see the bottom of this answer)
The application uses a simple Substitution Cipher (Or, to be exact Caesar Cipher with shift 4) and then perform reverse() on the function.
We can domnstrate it using python's maketrans method:
The method maketrans() returns a translation table that maps each
These are binary representation of double numbers encoded with base64.
To understand the encoding lets see an example (I used to convert numbers to binary double representation with this page):
0.03 = 0x3F9EB851EB851EB8 (binary representation of the double number)
With little endian encoding it is stored in the memory in the following form:
B8 1E 85 EB ...
I would start with checking the first bytes of a file after base64 decoding. Those would indicate what file format is.
MZ(5A4D) - meaning this is an executable file and you can start with executing it in save (virtual) environment with SysInternals utilities open - ProcMon and Process explorer. In addition, calculate its MD5 value and look it in the Net, ...
In case you're still trying to figure this out, I've made some progress. With assistance from u/jccool5000 on reddit (post), who has a collection of over 900 samples mostly from Ontario. AFAIK, Ontario and NJ share the same encoding - Quebec, not so sure. I did some data manipulation to figure this out.
Starting with the numbers of the last name, 1st of 4 ...
I don't see this above, but male or female is coded in as well. in the last five digits, the first 2 are month of birth. Males are 01-12. Females 50 is added. so the run from 51 (january) to 62 (december)
Also, my name is Alexandra, which is also 019 as is your example of alexander.
The absence of a middle name is reflected as 00
i know a friend with ...
To call an interrupt, you'll probably want to use int imm8 which is encoded as 0xcd, 0xnn (0x10 in this case).
For bootloaders, it's pretty common to stick the data in between the jmp at the start of the bootloader and its target. You don't really need to mess around with ds unless you're making a very large bootloader (which loads additional sectors from ...
81 c0 40 00 can be broken down as follows
10 00000 111000 00001 0 0000000000000
To change the target from %g1 to %g2, just change the rs1 field from 00001 to 00010.
The 'L' is simply an artifact of at&t syntax vs intel syntax....
Regarding (2), you don't load the entire string into the segment register, you take the selector for the memory region that holds the string, and place that into the segment register. For 16-bit bootloader environment, it's probably going to be the same as CS, so you just push cs, pop ds (though usually cs=ds=es=ss already on startup, anyway).
To write to ...
Many states use something called SoundEx to generate license numbers (sometimes you even see SoundEx on government forms and/or computer screens when they ask for drivers license numbers.)
The soundex system was designed to phonetically map names that sound similar to close values, even though they might be spelled wildly differently eg Pheiffer vs Fifer)
You could give a shot at dynamic binary visualization. There's an excellent presentation given by Christopher Domas at REcon as well at BlackHat 2013. The deck for REcon is available here.
I believe the tool is out now in beta so you could give a try at it.
When I looked into the URL, I can see that the base64 encoded data is having newline character.
When you remove newline characters and present that as one single line to openssl, you need the -A option.
The below will work fine.
$openssl enc -A -d -base64 <<< /9j/...
This might be base64, Although it is missing the required padding. base64 encoded string lengths are 4*(n/3) where n is the original string. Padding is done with one or two equal (=) marks. Since your string is 110 bytes long, it should end with two padding bytes.
Manually adding the two padding bytes (which are sometimes omitted because they're predictable)...
Guntram Blohm seems to be right. But in the spirit of "give a man a fish and he has food for one day", magic mime is an easy way to figure out most formats. The file command detects filetypes by their "magic" mime, i.e. markers left in the file (like you see %PDF in PDFs and PK in zip files).
file accepts as argument a filename, like file /tmp/unknown-file. ...
Based on your examples, it looks like the strings are reversed and each byte is XORed with the byte 4. Here's a quick Perl one-liner to demonstrate this:
perl -lne 'print reverse($_) ^ ("\x04" x length($_))'
and what happens when you apply it to your test strings:
$ cat test.txt
This is what I would do given the very limited information:
Start by examining the file in a hex editor like HxD or 010 Editor. Take note of any "constants." For example, all Windows exe files start with the bytes 4D 5A or "MZ". Do these files start with a consistent byte signature? Scroll down in the hex editor and find out what other patterns you can find....
Consider a "gap" to be a "low" interval between two consecutive "high" interval, ignoring the first longest one. Then, a bit 1 corresponds to a long gap, and a bit 0 corresponds to a short gap.
Therefore, the messages decoded that way are:
88 14 4b 00 ee : Light
84 14 4b 00 de : Beep
81 14 4b 00 7e : Zap
82 14 4b ...
If you can, you should post links to 2-3 of your real targa images, and the corresponding game targa images (beware of license issues though). Sometimes, looking at the files rings a bell, and i could have checked much of what i'm going to say if it works for your files or not.
Are some of the tga files referenced from Lua? There is Lua source ...
There's not much information to go on, but I would probably try to proceed like this:
Figure out how the web server is running (e.g. what is the server process?) and where are the pages and any additional code handling user input (servlets?)
Analyze the code and try to find where the recovery mode is triggered and how the code is checked. If it's Java, ...