how to decrypt keystroke packets?
54zhangxun opened this issue · 1 comments
54zhangxun commented
Hi,
According Pictures(about Decrypting Keystrokes)
{0x0A, 0x78, 0x06, 0x01, 0xC2, 0x98, 0x76, 0x0A, 0xC0, 0xC8, 0x98, 0x35, 0x0A, 0xC0, 0xCD, 0x5B};
==>
{0x0A, 0x78, 0x06, 0x01, 0x0F, 0x00, 0x43, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
How to get?
I do not understand this decryption method you provide!
samyk commented
It's explained in the video and here: http://samy.pl/keysweeper/#dec
Encryption starts on the 5th byte in the packet. You can take the MAC address and xor each byte with the current byte of the MAC, then for the next byte xor with the next byte of the MAC. Do this until you're out of MAC bytes, then start from the beginning of the MAC again (ECB mode).