 Courtesy of Fravia's page of reverse engineering
Well, this "bozo cracks java" probe reminds me a lot the "triplet" and "ponderated" solution used by Tom in his probe in order to enter the advanced javascript page... one cracker, one solution, many advanced pages? Back to Devious javascript

Tom to Fravia+: 26 March 1998

```

A beautiful one! But we are lucky! No password nor

username were longer than 8 characters and no digits! I

think that the next puzzles will be tougher :-)

After a quick look at the ciphering routines, I gave up

in reversing them: too many floating point problems :(

We can only see that usernames/passwords are not longer

than 10 characters and that targeted page names are

composed of digits.

Let's brute-force:

First try: open all pages with 6 digits names... erhhh

gasp! Forget it ;-)

Second one: I used here the same method than the one I

used to solve the "advanced JavaScript page" puzzle: a

"good English" generator.

Step 1: I've written a little proggy to extract all

letter triplets found in some English texts (downloaded

from a "Project Guttenberg" like site) and stored them

in a "dictionary" file.

Step 2: I grabbed the JavaScript code and converted it

into C++ (straightforward). I kept only the F1() and

F2() functions, etc...

Here's the code:

```
<hR> // bozo cracks java #include "devious.h" #define PASS_MAX_LEN 8 const char chars[] = { //'0', '1', '2', '3', '4', '5', '6', '7', '8', '9', // 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', // 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z'}; // 'e', 's', 'i', 'a', 'r', 'n', 't', 'o', 'l', // 'c', 'd', 'u', 'g', 'p', 'm', 'h', 'b', 'y', 'f', 'v', // 'k', 'w', 'z', 'x', 'j', 'q' }; const __int64 targets[] = { 503200105325677i64, 456044102492218i64, 520110587168960i64, // user 1 478419813816428i64, 500743010138384i64, 493738475696228i64, // user 2 553135480475728i64, 513985012252611i64, 446605401950626i64, // user 3 191979145621879i64, 251426266017281i64, 541311557611052i64, // user 4 498890444152004i64, 500743010138384i64, 417600367517742i64, // user 5 478419813816428i64, 492060879591955i64, 485366930586647i64 }; // user 6 int* triplets = NULL; const int nTriplets = 26*26*26; const int nChars = sizeof(chars)/sizeof(char); const int nTargets = sizeof(targets)/sizeof(__int64); clock_t tm = 0; __int64 count = 0; char buf[PASS_MAX_LEN+1]; __int64 pow1[PASS_MAX_LEN], pow2[PASS_MAX_LEN]; // precalculated pows int toBase36['a' + 26]; // converts '9' to 9, 'a' to 10 etc... int by26[26*26]; // precalculated products by 26 //* JavaScript Code ******************************************************* // // Encryption operators // You got to alter the following values to get your // own unique encryption code // // 1. The values should be within 0 ... 7 double fi11=2.232, fi12=0.372, fi13=1.322, fi14=5.322, fi15=2.322, fi16=3.771, fi17=2.313, fi18=1.300; double fi21=5.112, fi22=1.472, fi23=4.322, fi24=1.792, fi25=6.737, fi26=2.141, fi27=2.882, fi28=1.382; double fi31=3.342, fi32=5.352, fi33=1.732, fi34=3.008, fi35=1.399, fi36=5.999, fi37=4.913, fi38=2.578; double fi41=3.773, fi42=2.348, fi43=5.769, fi44=2.112, fi45=1.922, fi46=3.573, fi47=3.317, fi48=6.273; double fj11=0.732, fj12=4.732, fj13=4.732, fj14=0.732; double fj21=1.742, fj22=0.102, fj23=1.001, fj24=6.272; double fj31=4.732, fj32=6.212, fj33=6.001, fj34=6.212; double fj41=3.273, fj42=2.723, fj43=1.392, fj44=0.039; double m11=5.7193, m12=5.3732, m13=4.8313, m14=2.3991; double m21=3.3923, m22=3.3021, m23=6.4622, m24=1.1392; double m31=5.3991, m32=2.3010, m33=5.9223, m34=5.8283; double m41=2.3042, m42=1.3923, m43=1.2419, m44=0.3573; // // 2. The following values should be within limits 9.9999 ... 0.0001 // double k11=3.8173, k12=7.2094, k13=0.0001, k14=6.0202, k15=1.9294, k16=0.0011, k17=0.0033, k18=0.0492; double k21=1.3048, k22=0.0083, k23=0.0038, k24=0.0302, k25=2.3935, k26=9.4007, k27=4.2042, k28=0.0004; double k31=0.0298, k32=3.0020, k33=0.0912, k34=0.0123, k35=0.2033, k36=0.0001, k37=3.0034, k38=0.0009; double k41=0.2094, k42=9.0031, k43=5.2059, k44=2.4010, k45=0.0324, k46=0.0023, k47=0.2034, k48=9.9414; // // 3. 'Bases' should be within limits 10...36 (only integer!) // int base1=29, base2=31; // -------------------------------------------- // End of JS code // <hR> // My code starts here // inline int hurts(char* s) { // wait for a three letter string /* if( (s >= '0' && s <= '9') || (s >= '0' && s <= '9') || (s >= '0' && s <= '9') ) return 0; // ignore digits */ return triplets[by26[by26[s - 'a'] + s - 'a'] + s - 'a']; } // the heart of the crack, for each good triplet we store a 1 in // the triplets array at position [26*26*(char 1) + 26*(char 2) + (char 3)] // I used the same technique to generate the input file void getTriplets() { int c, i = 0, idx = 0; while( (c = getchar()) != EOF ) { // skip white spaces if( c == '\n' || c == '\r' || c == ' ' || c == '\t' ) continue; // there are only a-z chars in the generated file if( c < 'a' || c > 'z' ) break; idx *= 26; idx += c - 'a'; if( ++i == 3 ) { triplets[idx] = 1; idx = i = 0; } } } void generate(int n) { static int j, x; static __int64 r1, r2; static __int64 z1 = 0, z2 = 0; static __int64 zz1[PASS_MAX_LEN], zz2[PASS_MAX_LEN]; int i; for( i = 0; i < nChars; i++ ) { x = toBase36[buf[n] = chars[i]]; zz1[n] = z1; zz2[n] = z2; z1 += pow1[n][x]; z2 += pow2[n][x]; if( n < 2 || hurts(&buf[n-2]) != 0 ) { r1 = (__int64)floor(5e14 * sin(m11*sin(z1*k11+fi11) * cos(z1*k12+fi12)+fj11) * sin(m12*sin(z1*k13+fi13) * cos(z1*k14+fi14)+fj12) * sin(m13*sin(z1*k15+fi15) * cos(z1*k16+fi16)+fj13) * sin(m14*sin(z1*k17+fi17) * cos(z1*k18+fi18)+fj14) + 5e14); r2 = (__int64)floor(5e14 * sin(m21*sin(z2*k21+fi21) * cos(z2*k22+fi22)+fj21) * sin(m22*sin(z2*k23+fi23) * cos(z2*k24+fi24)+fj22) * sin(m23*sin(z2*k25+fi25) * cos(z2*k26+fi26)+fj23) * sin(m24*sin(z2*k27+fi27) * cos(z2*k28+fi28)+fj24) + 5e14); count++; for(j = 0; j < nTargets; j += 3) { if( r1 == targets[j] ) { buf[n+1] = 0; printf("%d %c ID : %s\n", j/3+1, ((r1 == targets[j])?' ':'?'), buf); } if( r2 == targets[j+1] ) { buf[n+1] = 0; printf("%d %c PASS: %s\n", j/3+1, ((r2 == targets[j+1])?' ':'?'), buf); } } // next step if( (n+1) < PASS_MAX_LEN ) generate(n+1); } z1 = zz1[n]; z2 = zz2[n]; } } int main(int argc, char** argv) { int i, j; triplets = new int[nTriplets]; memset(triplets, 0, nTriplets * sizeof(int)); getTriplets(); // arrays init // charset to base36 digits for(i = 0; i < 'a' + 26; i++) { if( i >= '0' && i <= '9' ) toBase36[i] = i - '0'; else if( i >= 'a' && i <= 'z' ) toBase36[i] = i - 'a' + 10; else toBase36[i] = 0; } // by 26 products for( i = 0; i < 26 * 26; i++ ) by26[i] = i * 26; // powers precalculation for(i = 0; i < PASS_MAX_LEN; i++) { for( j = 0; j < 36; j++) { pow1[i][j] = (__int64)(pow(base1, i) * j); pow2[i][j] = (__int64)(pow(base2, i) * j); } } memset(buf, 0, sizeof(buf)/sizeof(char)); tm = clock(); generate(0); delete [] triplets; fprintf(stderr, "Computed %I64d possibilities in %.2lfs\n", count, (double)((clock() - tm) / (double)CLOCKS_PER_SEC ) ); return 0; }
```

Ok, that's not well commented but it should be

understandable for all the fellow reverse engineers who

As you should already have noticed, the dictionary file

must be redirected to this program's stdin.

I've tested this proggy with different PASS_MAX_LEN

values:

PASS_MAX_LEN =  4	     46,816 possibilities	 0.6 s

PASS_MAX_LEN =  5	    526,561 possibilities	 6.6 s

PASS_MAX_LEN =  6	  5,850,107 possibilities	75.0 s

PASS_MAX_LEN =  7	 65,730,742 possibilities	14.0 minutes

Uh ? where are we going ?

PASS_MAX_LEN =  8	736,318,988 possibilities	2 hours 38 minutes

I finally got it after 2 hours 38 minutes... I must say

that the only missing one was "mozilla" because "moz"

didn't figure in my dictionary of 3700 triplets :-( A

short estimation tells us that 10 letters usernames and

passwords would have required 14 days of computation!

Still in "good English". We could include an "error

tolerance" check in this code in order to handle digits

and other junk like mozilla, but I let you imagine the

time required to get in :-D

I still don't think that brute forcing was the right

solution: does anyone know what happened on 16/05/93

(DD/MM/YY format) ;-)

Sincerely yours

Tom.

Tomflame/usa_net (the real syntax is trivial)	// spam@you.net

```
(c) 1998 Tom All rights reversed

You are deep inside Fravia's page of reverse engineering, choose your way out: Back to Devious Javascript homepage links anonymity +ORC students' essays academy database tools cocktails javascripts wars antismut CGI-scripts search_forms mail_Fravia Is reverse engineering legal?