samyk/keysweeper

how to decrypt keystroke packets?

54zhangxun opened this issue · 1 comments

Hi,
According Pictures(about Decrypting Keystrokes)
{0x0A, 0x78, 0x06, 0x01, 0xC2, 0x98, 0x76, 0x0A, 0xC0, 0xC8, 0x98, 0x35, 0x0A, 0xC0, 0xCD, 0x5B};
==>
{0x0A, 0x78, 0x06, 0x01, 0x0F, 0x00, 0x43, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};

How to get?
I do not understand this decryption method you provide!

samyk commented

It's explained in the video and here: http://samy.pl/keysweeper/#dec

Encryption starts on the 5th byte in the packet. You can take the MAC address and xor each byte with the current byte of the MAC, then for the next byte xor with the next byte of the MAC. Do this until you're out of MAC bytes, then start from the beginning of the MAC again (ECB mode).