| MATH keygen |
[Click to reveal]Hi Mazzotti — "MATH keygen" was a fantastic rabbit hole, thank you :3
Quick summary of where I got: fully reversed check(). Per character it computes bytesum (signed), three trunc(sin/cos(u2d(x))·1000) stages, and glibc srandom()/random() reseeded every character; the carrier is ×(2·k1+1) then XOR a bounded mask, pushing one 64-bit word per character, and success needs the 128-bit sum to equal EXACTLY 0x1d24347a11c16a54a6. I re-implemented it bit-for-bit and validated against your binary via gdb (read the internal sum at the compare), and wrote a CUDA/hashcat cracker too — so I'm confident I have the real algorithm (a solver of your "Next generation" even described the same glibc-PRNG method).
Where I'm stuck: the exact 128-bit target. Inversion runs into the fixpoint where every mask depends on the value being solved (via sin/cos + the reseeded PRNG), and I empirically ruled out linear/ARX, Gröbner, MITM, SMT (times out by 3 cycles) and differential paths — all converge on a ~2^64 needle for the low 64 bits, with acc being a full-entropy chained mixer and bytesum coupling globally.
Could you confirm whether there's an intended shortcut I'm missing, or — if it's genuinely meant to be found by knowing the key — would you be willing to share the intended password (or its length/character set)? I'd love to close the loop and verify it against my oracle. Either way, huge respect for the design. :3
|
2026-08-07 18:02 |