Chaos Project

---

Introduction

I've created my own string encryption system. I basically wanted to create this so I could have my
own secure way of accessing my mysql database between PHP and C#. I was working on my website then
I was going to make a C# program that acted as the admin page. Well at the time I didn't have the
C# method of PHP's crypt().

So I started working on my own and I say I've done a decent job at scrambling letters and numbers.
I'm putting this up to see if anyone can identify the pattern I used in my encryption system. Which
is basically how the letters from both the salt and word are placed, how the numbers are generated,
and whatnot.

I want to expand on this, create the system more complex and secure yet have the outcoming result simple.
Anyways, I've succeeded for my own personal needs for the method but I definitely would like to improve
on it.

---

Demos

So if you want to test and experiment with it, go right ahead. I've created the algorithm in both
PHP and C#.

PHP Web Version (http://decisive-media.net/gameguy/crypt.php)
C# Windows Version (http://decisive-media.net/gameguy/crypt.zip)

---

Notes

Now I'm not asking anybody to completely decrypt the pattern I've generated, I just want to see how
visible the patterns are to someone else.

At the time I do not plan on releasing the source. A side note, this method works like
PHP's crypt in a sense where theres no method for reversing the encrypted string. So basically...
User: password = haithar
Generates to - fjdsl8048923fds (not real end result :P)
that code is then sent to the database to see if it matches with the recorded one. Basically the same
way RMX-OS is.

Lol, if I try to open the PHP file, it executes the file instead of showing the source. xD

Wow. Sorry about the PHP version. I'm running xampp and I used a label in my code.
e.g.
a:
goto a;

But brandens host is taking it as a syntax error. I'll try and fix it.

EDIT: Did a little code modifying and removed the need for a label and goto. Should work now.

That, too. xD

There is a way to not execute some PHP files. I forgot it, though. You can always have that script somewhere on the side and link to a PHP script that will open the other script as a normal file and simply echo everything inside.

Think you might have missed my edit. I fixed it and you should be able to use it now. And I'm not sure what you mean by showing the source. I released it so you could test the generation of the algorithm on a web version so you wouldn't have to download the C# version to test it. The method isn't publically released as of now.

Now if you want to view the source to my method I'll PM it to you.

Nah, it's fine. :)

Booya

05271995 01082002

I don't get it. what did you do zero?

Those are the base encryption strings. They are used in conjunction with the given salt to scramble the strings.

I see, you obtained them from the encryption?

No, I make no claims on being a hacker. I merely disassembled the executable and looked at the source code.

Bastard. Imma kill you >:U

It helped that I knew it was based off the .NET framework, since that is what you have been using. It may have taken a little longer not knowing that. Having that knowledge ahead of time made it easy.

so how dose having these salts help you, you still don;t have the math. or any ability to reverse it.

I have the entire project with the exact methods used to encrypt it, literally all of the source code. I just de-compiled the application, which you can do with managed C# easy enough.

Reversing CRL back into C#, VB.NET or any other .NET language is really not a big deal.

ah, nervermind then.

Quote from: Blizzard on February 14, 2011, 04:35:53 pm
Reversing CRL back into C#, VB.NET or any other .NET language is really not a big deal.

No, like I said, I'm no hacker. I merely know of Reflector (http://www.red-gate.com/products/dotnet-development/reflector/).

I shall punch you with a force of one thousand donkey kicks. A mere 1/10th force of chuck norris's sneeze.

Alright F0. Got the file uploaded. I modified the numbers and the methods. Have not updated the PHP version yet.

What is this?

-1859946763

I'm not quite as confident with this one. It is definetely harder this time. I would also recommend using a StringBuilder when encrypting the string, it waaaaay more efficient when doing repeated changes to a string, since it is not creating 1000's of copies of the string.  

First thing, there are two numbers, second thats not one of them, third each number has 8 digits, fourth I'll look into the string builder.

Its odd, I've been working with C# for awhile now, and just a few days ago I learned what obfuscating is. :facepalm:
EazObfuscator .NET is a great free obfuscator.
http://www.foss.kharkov.ua/g1/projects/eazfuscator/dotnet/Default.aspx

I'm using Vs 2010 Ultimate, it has one built in.   ;)

I see how it works, but it is still confusing. It appears it adds a bunch of useless data, and substitutes a bunch more. I did find an encrypted table, which I think may be used to revert stuff back. Not sure, I only spent about 5-10 minutes on it, but now that I know I'm wrong, it's nagging me so I'm gonna take a second look.  :wacko:


EDIT:
Okay, I think I see how you did it.
You pass two strings to the method, which is combined to make a new string. You then create string array the length of the combined string.

Each character in the string is iterated, converting each character to hexadecimal notation. Then, the whole string is multiplied by the corresponding character (converted to an integer) from th combined string. After all that, each character of this mess is changed to be equal to its index plus itself squared...



You then create a new string, which is made up of the absolute value of each character that went through this transformation.

I don't think there are any encryption strings to find. You simply do some math on what has been given as a salt.

Do you have me looking for things that aren't there?

Practically. Of course its not really an encryption system =\ but thats not gonna stop people from thinking it is >:3

Just like DREAM.
But realistically seen every obfuscation of data is an encryption.