Bueno, no voy a explicar porque la verdad no tengo el tiempo, pero dejo mis "ideas":
ROR 3 (bits)
7) 0001 1111 1111 1111 2220000000000000
6) 1111 1111 1111 1111 0000000000000000
5) 1111 1111 1111 1110 0000000000000001
4) 1111 1111 1111 0000 0000000000001111
3) 1111 1111 1000 0000 0000000001111111
2) 1111 1100 0000 0000 0000001111111111
1) 1110 0000 0000 0000 0001111111111111
0) 0000 0000 0000 0000 1111111111111111
usando 0FFFFh en DI
inicio : 0000FFFF
vuelta 1: E0001FFF
vuelta 2: FC0003FF
vuelta 3: FF80007F
vuelta 4: FFF0000F
Real
final: 97D1CB0E 1001 0111 1101 0001 1100101100001110
ROR EDI, 3 BE8E5874 1011 1110 1000 1110 0101100001110100
ADD DI,00 ==> 5874 = XXXX + YYZZ = XXXX + YY(ZZ) = XXXX + (char * 0Dh)
==> = 5874 + 0000 = 5874 + 00(00) = 5874 + (0h * 0Dh)
vuelta char 7: BE8E5874 1011 1110 1000 1110 0101100001110100
ROR EDI, 3 F472C3A5 1111 0100 0111 0010 1100001110100101
ADD DI,AX ==> C3A5 = XXXX + YYZZ = XXXX + YY(ZZ) = XXXX + (char * 0Eh)
==> = C??? + 0??? = C??? + 0?(??) = C??? + (??h * 0Eh)
vuelta char 6: F472C??? 1011 1110 1000 1110 1100????????????
ROR EDI, 3 F476???? 1111 0100 0111 0110 0????????????101
ADD DI,AX ==> ???? = XXXX + YYZZ = XXXX + YY(ZZ) = XXXX + (char * 0Fh)
==> = ???? + 0??? = ???? + 0?(??) = ???? + (??h * 0Fh)
vuelta char 5: F476???? 1111 0100 0111 0110 0???????????????
ROR EDI, 3 A3B0???? 1010 0011 1011 0000 ????????????????
ADD DI,AX ==> ???? = XXXX + YYZZ = XXXX + YY(ZZ) = XXXX + (char * 10h)
==> = ???? + 0??? = ???? + 0?(??) = ???? + (??h * 10h)
vuelta char 4: A3B0???? 1010 0011 1011 0000 ????????????????
ROR EDI, 3 1D80???? 0001 1101 1000 0000 ????????????????
ADD DI,AX ==> ???? = XXXX + YYZZ = XXXX + YY(ZZ) = XXXX + (char * 11h)
==> = ???? + ???? = ???? + ??(??) = ???? + (??h * 11h)
vuelta char 3: 1D80???? 0001 1101 1000 0000 ????????????????
ROR EDI, 3 EC00???? 1110 1100 0000 0000 ?????????????000
ADD DI,AX ==> ???N = XXXX + YYZZ = XXXX + YY(ZZ) = XXXX + (char * 12h) N = 0 o 8
==> = ???? + ???? = ???? + ??(??) = ???? + (??h * 12h)
vuelta char 2: EC00???? 1110 1100 0000 0000 ????????????????
ROR EDI, 3 6000???? 0110 0000 0000 0000 ?????????????111
ADD DI,AX ==> ???N = XXXX + YYZZ = XXXX + YY(ZZ) = XXXX + (char * 13h) N = 7 o F
==> = ???? + ???? = ???? + ??(??) = ???? + (??h * 13h)
vuelta char 1: 6000???? 0110 0000 0000 0000 ????????????????
ROR EDI, 3 0000???3 0000 0000 0000 0000 ????????????0011
ADD DI,AX ==> ???N = XXXX + YYZZ = XXXX + YY(ZZ) = XXXX + (char * 14h) N = 3
==> = 0000 + ???N = 0000 + ??(??) = 0000 + (??h * 14h) min 0294 / max 13D8
Maximos
final: AFA97B3E 1010 1111 1010 1001 0111101100111110
ROR EDI, 3 7D4BD9F5 0111 1101 0100 1011 1101100111110101
ADD DI,00 ==> D9F5 = XXXX + YYZZ = XXXX + YY(ZZ) = XXXX + (char * 0Dh)
==> = D9F5 + 0000 = D9F5 + 00(00) = D9F5 + (0h * 0Dh)
vuelta char 7: 7D4BD9F5 0111 1101 0100 1011 1101100111110101
ROR EDI, 3 EA5ECFAB 1110 1010 0101 1110 1100111110101011
ADD DI,AX ==> CFAB = XXXX + YYZZ = XXXX + YY(ZZ) = XXXX + (char * 0Eh)
==> = C218 + 0D93 = C218 + 0D(E4) = C218 + (FEh * 0Eh)
vuelta char 6: EA5EC218 1110 1010 0101 1110 1100001000011000
ROR EDI, 3 52F610C7 0101 0010 1111 0110 0001000011000111
ADD DI,AX ==> 10C7 = XXXX + YYZZ = XXXX + YY(ZZ) = XXXX + (char * 0Fh)
==> = 023C + 0E8B = 023C + 0E(E2) = 023C + (FEh * 0Fh)
vuelta char 5: 52F6023C 0101 0010 1111 0110 0000001000111100
ROR EDI, 3 97B011E2 1001 0111 1011 0000 0001000111100010
ADD DI,AX ==> 11E2 = XXXX + YYZZ = XXXX + YY(ZZ) = XXXX + (char * 10h)
==> = 025F + 0F83 = 025F + 0F(E0) = 025F + (FEh * 10h)
vuelta char 4: 97B0025F 1001 0111 1011 0000 0000001001011111
ROR EDI, 3 BD8012FC 1011 1101 1000 0000 0001001011111100
ADD DI,AX ==> 12FC = XXXX + YYZZ = XXXX + YY(ZZ) = XXXX + (char * 11h)
==> = 0281 + 107B = 0281 + 10(DE) = 0281 + (FEh * 11h)
vuelta char 3: BD800281 1011 1101 1000 0000 0000001010000001
ROR EDI, 3 EC00140D 1110 1100 0000 0000 0001010000001101
ADD DI,AX ==> 140D = XXXX + YYZZ = XXXX + YY(ZZ) = XXXX + (char * 12h)
==> = 029A + 1173 = 029A + 11(DC) = 029A + (FEh * 12h)
vuelta char 2: EC00029A 1110 1100 0000 0000 0000001010011010
ROR EDI, 3 600014D7 0110 0000 0000 0000 0001010011010111
ADD DI,AX ==> 14D7 = XXXX + YYZZ = XXXX + YY(ZZ) = XXXX + (char * 13h)
==> = 026C + 126B = 026C + 12(DA) = 026C + (FEh * 13h)
vuelta char 1: 6000026C 0110 0000 0000 0000 0000001001101100
ROR EDI, 3 00001363 0000 0000 0000 0000 0001001101100011
ADD DI,AX ==> 1363 = XXXX + YYZZ = XXXX + YY(ZZ) = XXXX + (char * 14h)
==> = 0000 + 1363 = 0000 + 13(D8) = 0000 + (FEh * 14h)
inicio: 00000000
El analisis final dió un semi-smart-bruteforcer (MASM)
.386
.MODEL flat,stdcall
OPTION CASEMAP:NONE
Include windows.inc
Include user32.inc
Include kernel32.inc
Include masm32.inc
IncludeLib user32.lib
IncludeLib kernel32.lib
Includelib masm32.lib
.DATA
lacad db "!!!!!!!",0
chars0 db 024h, 025h, 026h, 030h, 031h, 032h, 033h, 03Dh, 03Eh, 03Fh, 04Ah, 04Bh, 04Ch, 057h, 058h, 059h
db 064h, 065h, 066h, 070h, 071h, 072h, 073h, 07Dh, 07Eh, 07Fh, 0A4h, 0A5h, 0A6h, 0B0h, 0B1h, 0B2h
db 0B3h, 0BDh, 0BEh, 0BFh, 0CAh, 0CBh, 0CCh, 0D7h, 0D8h, 0D9h, 0E4h, 0E5h, 0E6h, 0F0h, 0F1h, 0F2h
db 0F3h, 0FDh, 0FEh
sep1 dd 0h
chars1 db 027h, 033h, 035h, 041h, 043h, 04Fh, 05Bh, 05Dh, 069h, 06Bh, 077h, 079h, 0A1h, 0ADh, 0AFh, 0BBh
db 0C7h, 0C9h, 0D5h, 0D7h, 0E3h, 0E5h, 0F1h, 0FDh, 021h, 02Dh, 02Fh, 03Bh, 047h, 049h, 055h, 057h
db 063h, 065h, 071h, 07Dh, 07Fh, 0A7h, 0B3h, 0B5h, 0C1h, 0C3h, 0CFh, 0DBh, 0DDh, 0E9h, 0EBh, 0F7h
db 0F9h, 026h, 028h, 034h, 040h, 042h, 04Eh, 050h, 05Ch, 05Eh, 06Ah, 076h, 078h, 0ACh, 0AEh, 0BAh
db 0BCh, 0C8h, 0CAh, 0D6h, 0E2h, 0E4h, 0F0h, 0F2h, 0FEh, 02Ch, 02Eh, 03Ah, 03Ch, 048h, 04Ah, 056h
db 062h, 064h, 070h, 072h, 07Eh, 0A6h, 0A8h, 0B4h, 0C0h, 0C2h, 0CEh, 0D0h, 0DCh, 0DEh, 0EAh, 0F6h
db 0F8h
sep2 dd 0h
fname db "sol.txt",0
.code
DllEntry proc hInstance:HINSTANCE, reason:DWORD, reserved1:DWORD
mov eax,TRUE
ret
DllEntry Endp
calcula proc uses ecx edi esi ptrcadena : DWORD
;
XOR EAX,EAX
XOR EDI,EDI
MOV ECX,14h
MOV ESI,ptrcadena
bucle:
LODS BYTE PTR DS:[ESI]
MUL CL
ROL AL,2
ADD DI,AX
ROR EDI,3
TEST AL,AL
LOOPNE bucle
MOV EAX,EDI
ret
calcula endp
;cmp eax, 097D1CB0Eh
brute proc uses ecx edx
;
local c1:DWORD
local c2:DWORD
local c0:DWORD
; init
mov c0, 0
mov c1, 0
mov c2, 0
mov eax, offset lacad
mov ecx, offset chars0
mov cl, byte ptr[ecx]
mov byte ptr [eax], cl
mov ecx, offset chars1
mov cl, byte ptr[ecx]
mov byte ptr [eax+1], cl
mov ecx, offset chars2
mov cl, byte ptr[ecx]
mov byte ptr [eax+2], cl
bucle:
invoke calcula, offset lacad
cmp eax, 097D1CB0Eh
je salida
mov eax, offset lacad
inc byte ptr [eax+6]
cmp byte ptr [eax+6],040h;07Eh
jbe bucle
mov byte ptr [eax+6],021h
inc byte ptr [eax+5]
cmp byte ptr [eax+5],040h;07Eh
jbe bucle
mov byte ptr [eax+5],021h
inc byte ptr [eax+4]
cmp byte ptr [eax+4],040h;07Eh
jbe bucle
mov byte ptr [eax+4],021h
inc byte ptr [eax+3]
cmp byte ptr [eax+3],040h;07Eh
jbe bucle
mov byte ptr [eax+3],021h
inc byte ptr [eax+2]
cmp byte ptr [eax+2],040h;07Eh
jbe bucle
mov byte ptr [eax+2],021h
inc c1
mov ecx, offset chars1
cmp c1,060h
jg s2
add ecx, c1
mov dl, byte ptr [ecx]
mov byte ptr [eax+1],dl
jmp bucle
s2:
mov c1, 0
mov dl, byte ptr [ecx]
mov byte ptr [eax+1],dl
inc c0
mov ecx, offset chars0
cmp c0,032h
jg s3
add ecx, c0
mov dl, byte ptr [ecx]
mov byte ptr [eax],dl
jmp bucle
s3:
mov byte ptr [eax],0FFh
mov byte ptr [eax+1],0FFh
mov byte ptr [eax+2],0FFh
mov byte ptr [eax+3],0FFh
mov byte ptr [eax+4],0FFh
mov byte ptr [eax+5],0FFh
mov byte ptr [eax+6],0FFh
salida:
invoke write_disk_file, offset fname, offset lacad, 7h
Ret
brute endp
Y una pass que hace colisión de hash es:
$.!.-*8Saludos!
Mostrar Mensajes
)