nothing happened

[johnny125]

#!/usr/bin/env python2

Author: Alamot

This is a XOR plaintext attack tool: If we know a part of the plaintext maybe

we can recover the key and the whole text.

from future import print_function
from future import division
import string, sys

ignore_code = 0xFF
printable_key = True
max_key_length = 21

def is_printable(text, ignore_code):
"""Function to check if every character in text is printable"""
for ch in text:
if ord(ch) == ignore_code:
continue
if ch not in string.printable:
return False
return True

def lrotate(s, d):
"""Function to rotate string left by d length"""
return s[d:] + s[0:d]

if len(sys.argv) < 2 or sys.argv[1].strip().lower() == "--help":
print(
"Known-plaintext attack:\n"
+ sys.argv[0]
+ " [max_key_length]"
)
print(
"\nDecrypt using known key:\n"
+ sys.argv[0]
+ " --key=the_known_key"
)
exit()

filename = sys.argv[1]

if sys.argv[2].strip().lower()[:5] == "--key":
known_key = sys.argv[2].strip()[6:]
with open(filename, "rb") as f:
data = f.read()
decrypted_text = ""
repeated_key = (known_key) * ((len(data) // len(known_key)) + 1)
for x in range(len(data)):
decrypted_text += chr(ord(data[x]) ^ ord(repeated_key[x]))
print(
"Key length: " + str(len(known_key)),
"\nPartial Key: " + known_key,
"\nPlaintext: " + decrypted_text,
)
exit()
else:
known_plaintext = sys.argv[2]

if len(known_plaintext) > max_key_length:
print(
"The length of the known plaintext is greater than max_key_length (="
+ str(max_key_length)
+ "). Please give a smaller plaintext or incrase max_key_length."
)
exit()

if len(sys.argv) > 3:
max_key_length = int(sys.argv[3]) + 1

with open(filename, "rb") as f:
data = f.read()

print(
"Searching XOR-encrypted "
+ filename
+ " for string '"
+ known_plaintext
+ "' (max_key_length = "
+ str(max_key_length - 1)
+ ")"
)

try:
for i in range(
len(data) - len(known_plaintext)
): # Try known plaintext in every position
partial_key = ""
for j in range(len(known_plaintext)):
if known_plaintext[j] == ignore_code:
partial_key += chr(ignore_code)
else:
partial_key += chr(ord(data[i + j]) ^ ord(known_plaintext[j]))
# print("Single key: "+partial_key)
if is_printable(partial_key, ignore_code) or not printable_key:
for n in range(
len(partial_key), max_key_length
): # Try different key lengths
for m in range(n): # Try different partial key positions
expanded_key = lrotate(
partial_key + chr(ignore_code) * (n - len(partial_key)), m
)
# print(expanded_key, m)
repeated_key = (expanded_key) * (
(len(data) // len(expanded_key)) + 1
)
decrypted_text = ""
for x in range(len(data)): # Try to decrypt the encoded text
if ord(repeated_key[x]) == ignore_code:
decrypted_text += chr(ignore_code)
else:
decrypted_text += chr(ord(data[x]) ^ ord(repeated_key[x]))
if is_printable(
decrypted_text, ignore_code
): # Is the whole result printable?
if known_plaintext in decrypted_text:
print(
"Key length: " + str(len(expanded_key)),
"\nPartial Key: " + expanded_key,
"\nPlaintext: " + decrypted_text,
)
print("")
except KeyboardInterrupt:
print("\nCtrl+C received. Exiting...")
exit()

I used this in the cmd : xorknown.py application.bin the 5 but it gives me this : Searching XOR-encrypted application.bin for string 'the' (max_key_length = 5) nothing happened