Thread: Byte Decryption

Hi all!

I am doing some packet decryption where the encryption method is unknown, so I just have the raw data.

I thought that receiving and decrypting large files on the fly is rather performance heavy with the simplest method:

Code:

switch(foo)
{
	case 0xAC:
		foo = 0x00;
		break;
	case 0x35:
		foo = 0x01;
		break;
	case 0x97:
		foo = 0x02;
		break;
...

That will make a maximum of 256 comparisions for each byte. Imagine a standard 100Mbit/s network, that's a maximum of 3.200.000.000 comparisions per second, but I only have a 2.000.000.000 Hz processor. Hence the decryption lags behind the file sent.


By comparing the encrypted and decrypted bytes as hex numbers and also as binary numbers, I couldn't find any scheme between them.

Here's the first 10 bytes to visualize it.

Code:

00 01 02 03 04 05 06 07 08 09 - decrypted
AC 35 97 0E DA 43 E1 78 40 D9 - encrypted

My goal is to make the decryption as fast as possible. Is there another way than finding similarities between bytes? What are possibilites to find similarities between bytes?

And a secondary question: With gcc, will the executable go top->bottom in a switch-case query?

TIA, Hawk

Just make a transformation array and index into it. Array needs to have 256 elements.

Are you sure the decryption is that simple? A simple substitution code?

I just realized my own how dumb I was
Thanks for your answer, of course I can just use an array, oh my god!

Yes, as I wrote, it is just byte decryption.

I imagine that a simple code breaker could also be written to attack substitution schemes like this with frequency analysis (LFQ). Then the most common letters can be printed out. A message like "hello world" would decode with LFQ to something like "htlla xorld" and then the user could tweak it from there by trying different letters. Granted we would need a much larger text sample than simply "hello world" for the code breaker to work...

Letter frequency - Wikipedia, the free encyclopedia