Identify XOR-hashing algorithm

Discussion in 'Reverser Knowledge Base' started by sxzbisid, Dec 18, 2017.

  1. sxzbisid

    sxzbisid is a Trusted Warez Postersxzbisid DEV Guild Member DEV Guild Reverser

    Joined:
    Jul 11, 2017
    Messages:
    138
    Likes Received:
    1,711
    Can you help me identify this 64-bit xor-hashing algo, please?

    Code:
            private static ulong Xor64(string path)
            {
                var byteArray = File.ReadAllBytes(path);
                var length = byteArray.Length;
                var octets = length / 8;
    
                var index = 0;
    
                var out0 = 161;
                var out1 = 190;
                var out2 = 81;
                var out3 = 118;
                var out4 = 154;
                var out5 = 165;
                var out6 = 184;
                var out7 = 141;
    
                for (var i = 0; i < octets; i += 8)
                {
                    var byte0 = byteArray[index++];
                    var byte1 = byteArray[index++];
                    var byte2 = byteArray[index++];
                    var byte3 = byteArray[index++];
                    var byte4 = byteArray[index++];
                    var byte5 = byteArray[index++];
                    var byte6 = byteArray[index++];
                    var byte7 = byteArray[index++];
    
                    out0 = (byte)(out0 ^ byte0 ^ byte2 ^ out3);
                    out1 = (byte)(out1 ^ byte1 ^ byte4 ^ out2);
                    out2 = (byte)(out2 ^ byte2 ^ byte0 ^ out7);
                    out3 = (byte)(out3 ^ byte3 ^ byte5 ^ out0);
                    out4 = (byte)(out4 ^ byte4 ^ byte3 ^ out5);
                    out5 = (byte)(out5 ^ byte5 ^ byte1 ^ out6);
                    out6 = (byte)(out6 ^ byte6 ^ byte6 ^ out1);
                    out7 = (byte)(out7 ^ byte7 ^ byte7 ^ out4);
    
                }
    
                return (ulong)out0 + ((ulong)out1 << 8) + ((ulong)out2 << 16) + ((ulong)out3 << 24) + ((ulong)out4 << 32) + ((ulong)out5 << 40) + ((ulong)out6 << 48) + ((ulong)out7 << 56);
            }
     
    Stirg likes this.
  2. sxzbisid

    sxzbisid is a Trusted Warez Postersxzbisid DEV Guild Member DEV Guild Reverser

    Joined:
    Jul 11, 2017
    Messages:
    138
    Likes Received:
    1,711
    Identify or crack /to produce wanted return by providing additional input bytes/.
     
    Stirg and Markat like this.
  3. dr

    drunkenmyno Registered User

    Joined:
    Aug 15, 2017
    Messages:
    23
    Likes Received:
    187
    Hey ,

    The First outs definition looks like ascii codes then it reads each 8 bit octect and do the math. so this is nor a 64 bit xor its 32 bit

    each out (octects) can xored until finished and it get final shifted and would give you a hash sum.

    its not enough to say what it is doing
     
  4. sxzbisid

    sxzbisid is a Trusted Warez Postersxzbisid DEV Guild Member DEV Guild Reverser

    Joined:
    Jul 11, 2017
    Messages:
    138
    Likes Received:
    1,711
    Thank you @drunkenmyno for your reply, however I am not sure what's on your mind, can you explain it in detail, please?

    32-bit, sorry? Eight octets with 8 bytes, 8*8=64.

    We know exactly what it's doing, take a look at the simple source code above. I am asking for cracking the algo or identifying it of someone recognize it as some known algo.
     
    Last edited by a moderator: Dec 22, 2017
    Stirg likes this.
  5. by

    byqmcywc Registered User

    Joined:
    Feb 15, 2018
    Messages:
    10
    Likes Received:
    17
    guess you mean find collision? =>
    What you have: path + output
    What you want: alternative-path-string
     
    Stirg likes this.
  6. sxzbisid

    sxzbisid is a Trusted Warez Postersxzbisid DEV Guild Member DEV Guild Reverser

    Joined:
    Jul 11, 2017
    Messages:
    138
    Likes Received:
    1,711
    As written above: Identify or produce wanted return by providing additional input bytes for the same file (parameter path).
     
    Stirg likes this.
  7. by

    byqmcywc Registered User

    Joined:
    Feb 15, 2018
    Messages:
    10
    Likes Received:
    17
    just to confirm,
    what you have: path, output
    what you want: path+input bytes, same output?
     
    Stirg likes this.
  8. sxzbisid

    sxzbisid is a Trusted Warez Postersxzbisid DEV Guild Member DEV Guild Reverser

    Joined:
    Jul 11, 2017
    Messages:
    138
    Likes Received:
    1,711
    Parameter path means filename. So I've got file as a function input - parameter. And I know/ I can calculate the output of this XOR function. I want to add some bytes to this file to produce same function output.
     
    Stirg likes this.
  9. Mr

    MrSmithr Registered User

    Joined:
    Dec 23, 2017
    Messages:
    43
    Likes Received:
    559
    Correct me if I am wrong but what it seems you want to do is "ignore" the extra input bytes. You could check the whole length of bytes, compare and do some function based on that result. Append the extra input bytes to the end at a set length then you will know the exact size as to not interfere with the algo result.

    If anything else is needed to be done with those extra input bytes, then you will be able to use them as you see fit.

    @sxzbisid
     
    Last edited by a moderator: Mar 12, 2018
    Stirg likes this.