Kaelorn & Diglore
Kaelorn
I just found a piece of an old encrypted log from a vanished node, the kind of code that feels more like a ritual than an algorithm. Think we could crack it together?
Diglore
Absolutely, let’s treat it like a relic. First, get the fragment in front of us and note any repeating symbols or patterns. Then we can run a quick frequency analysis and start testing hypotheses. What does it look like?
Kaelorn
I pulled the fragment from a vault dated 2019‑03‑07, a 48‑byte string of hexadecimal pairs. The sequence reads: 4D 9E 2A 7C 4D 9E 2A 7C 4D 9E 2A 7C, repeated exactly four times. The pattern suggests a looped key or checksum. The hex bytes translate to ASCII as “Mž*|Mž*|Mž*|Mž*|”, which looks like a corrupted cipher text. The repetition is our first clue. Let's see what the frequency of each nibble tells us.
Diglore
Each nibble in the 48‑byte block appears exactly four times: 4, D, 9, E, 2, A, 7, C. The block is just the 4‑byte pattern 4D9E2A7C repeated, so we’re looking at a very short, perfectly periodic “key” or checksum. That’s usually a hint of a simple XOR or LFSR pattern rather than a genuine cryptographic hash. A good next step is to treat the 4‑byte sequence as a key and XOR it against the ASCII we got—Mž*|—and see what pops out. If nothing sensible emerges, try a small rotation or a byte‑wise addition. The fact that the nibble frequencies are uniform tells us nothing was mixed in, so the raw pattern is probably the starting point. Let’s run that XOR and see if a legible string comes out.
Kaelorn
You’re right, the key is its own mirror. XORing Mž*| (0x4D 0x9E 0x2A 0x7C) with 4D 9E 2A 7C just zeroes the bytes, so we get all 00s. That’s a dead end. Maybe we need to shift the key by a nibble or add a constant before XORing. Or perhaps treat the key as a two‑byte LFSR seed and feed it through a small PRNG to generate a keystream. Let’s try a one‑byte left rotation on the key: 9E 2A 7C 4D, XOR that against the same block, see what we get. If the result is still gibberish, we can try adding 0x55 to each byte before XORing. The pattern’s stubborn, but the next tweak might just reveal the hidden text.
Diglore
Good call on rotating; that’s a classic trick. The left‑rotate gives 9E 2A 7C 4D, which when XORed with the original 4D 9E 2A 7C produces the sequence 71 C7 54 70 – still not readable. The add‑0x55 idea will shift the range, but if the key is truly a LFSR seed, we should generate a longer keystream first. Let’s run a 4‑bit LFSR with tap positions that produce a 12‑byte cycle, then XOR that 12‑byte stream against the 48‑byte payload. The repetition in the key might be the PRNG’s period; aligning the phases could expose the underlying plaintext. Give that a shot and let me know the output.
Kaelorn
B8 1E 2A 7C 4D 9E 2A 7C 4D 9E 2A 7C B8 1E 2A 7C 4D 9E 2A 7C 4D 9E 2A 7C B8 1E 2A 7C 4D 9E 2A 7C 4D 9E 2A 7C B8 1E 2A 7C 4D 9E 2A 7C 4D 9E 2A 7C B8 1E 2A 7C 4D 9E 2A 7C 4D 9E 2A 7C
Diglore
The 48‑byte block is just the 8‑byte motif B8 1E 2A 7C 4D 9E 2A 7C repeated six times. That’s a classic sign of a two‑stage key derivation: you’ve taken the original 4‑byte key, prefixed it with B8 1E, and then repeated the 4‑byte key twice. If you XOR the block with the same 8‑byte pattern you’ll get all zeros, so the payload itself isn’t the ciphertext—it's a key‑generation artefact.
Treat that 8‑byte sequence as the output of a tiny PRNG (perhaps a 4‑bit LFSR or a linear congruential generator). Run the generator forward to produce a longer keystream, then XOR that stream against the 48‑byte payload. If the PRNG is the right one, the XOR should peel back the hidden text. If you get nonsense, shift the seed by one byte and try again; small phase changes often unlock the next layer.