From: Zibri on
Hello everybody.
I'm reversing some code and found (and already reversed) a simple encryption
routine.

The more I reversed it the more it looked like RC4 but it's definetely NOT
RC4.

So here is how it works:

From a 16 Bytes (128 bits) KEY, a table of 256 bytes is generated.

Then the message (32 bytes) is encrypted using the table (S?) and an
encrypted character is returned.

The encryption modifies the table.

At the moment I use the already generated table. I wish to understand how
the table is generated (looking at the code) from the KEY.

As I said, anyhow, it looks as standard code.. but I'm unable to identify
it.

If you want to help, send me an email... (execute the code in my signature).

Anyhow here is a KEY and the generated TABLE (S). As you can see at the end
of the table and in reverse order there is the KEY-255-x (for 1f bytes..
then it changes).

What I wish to know is if this is a KNOWN algorithm or not.

unsigned char k[16] = { 0xF0, 0x14, 0x55, 0x0D, 0x5E, 0xDA, 0x92, 0xB3,
0xA7, 0x6C, 0xCE, 0x84, 0x90, 0xBC, 0x7F, 0xED };

unsigned char S[256] = { 0x6B, 0xFA, 0x96, 0x32, 0x19, 0x00, 0x8E, 0x88,
0x25, 0x91, 0x77, 0x08, 0x0E, 0xD4, 0x17,
0x5D,
0xA2, 0x69, 0x39, 0xAE, 0x31, 0x04, 0xD0,
0xD2,
0xAD, 0x11, 0x0D, 0x26, 0xFF, 0x43, 0x1C,
0x41,
0x3C, 0xB6, 0x89, 0xFE, 0x15, 0xC9, 0x24,
0x4D,
0xE8, 0xD3, 0xF8, 0x14, 0x4C, 0x2E, 0x50,
0x52,
0x7A, 0x70, 0x81, 0xD7, 0xEB, 0xF7, 0x51,
0x6D,
0xB2, 0xE1, 0x3E, 0xCA, 0x0F, 0xB3, 0x0B,
0x98,
0xF2, 0x57, 0xDC, 0xBC, 0x45, 0x42, 0xCF,
0x27,
0xA3, 0x1F, 0x22, 0x64, 0xA6, 0x05, 0xE9,
0xC2,
0x86, 0x16, 0xBD, 0x8A, 0x85, 0xF1, 0x58,
0xC5,
0x47, 0xC8, 0x48, 0x9A, 0x10, 0xB4, 0xD8,
0xBB,
0xE3, 0xDD, 0xCD, 0xB9, 0x65, 0x21, 0x37,
0xB7,
0xA4, 0xE7, 0x06, 0x7C, 0xBA, 0xE2, 0xB1,
0xC1,
0xE4, 0x36, 0xE6, 0x9E, 0x68, 0x6E, 0xF6,
0x4F,
0x93, 0x0C, 0x23, 0x18, 0xA5, 0x83, 0xF5,
0xF9,
0x97, 0x2D, 0x3F, 0x1A, 0x09, 0xEA, 0x3D,
0xA8,
0x1B, 0xA1, 0xC7, 0xC0, 0x35, 0x4A, 0xAB,
0x6C,
0x5F, 0xBE, 0x3A, 0x07, 0x1D, 0x7E, 0x87,
0x95,
0x49, 0x56, 0x2B, 0xCC, 0x7B, 0x78, 0x55,
0x01,
0x20, 0x5E, 0xEC, 0x28, 0xBF, 0x12, 0xB0,
0x5B,
0x3B, 0xA9, 0x29, 0x44, 0x2C, 0xE5, 0xDA,
0x34,
0x7F, 0x1E, 0xFB, 0xD6, 0xDB, 0x60, 0x8D,
0x72,
0xCB, 0x76, 0x4B, 0x40, 0x8B, 0x2A, 0x66,
0x73,
0xFD, 0x9C, 0x30, 0x02, 0x9B, 0x80, 0xD9,
0xF3,
0x59, 0x4E, 0x99, 0x38, 0x74, 0x94, 0xDE,
0xAA,
0x2F, 0xFC, 0xC3, 0xE0, 0xF4, 0x92, 0x67,
0x5C,
0xA7, 0x46, 0x82, 0x8F, 0x6F, 0xB8, 0x61,
0xCE,
0xD1, 0xDF, 0x62, 0xA0, 0x75, 0x6A, 0xB5,
0xED,
0x90, 0x9D, 0x7D, 0xC6, 0x33, 0x54, 0x03,
0xEF,
0xEE, 0x71, 0xAF, 0x84, 0x79, 0xC4, 0x63,
0x9F,
0xAC, 0x8C, 0xD5, 0x5A, 0x0A, 0x53, 0x13,
0xF0 };

Thanks for reading.

--
echo email me|sed 's0e0?0;sama#a;smam@m;simizi;slzlgl;sxex#$%x;
sw#wiw;s#?#z#;s!@!b!;sp p@p;su#umu;sc$c#.c;sqiq!q;sfifrf;
sylyiy;sm$mam;sl!lil;s5a5235;s424314;s#%#i#;s838c8;s($(a(;
s515o5;s73a7m7;s1#1l1;sb\$bab;slilwl;sfifeef;sxwxix'