what happened to my post about reverse engineering encryption algorithm from last day?i'm sure I posted it, but I can't find it nowi figured that it is probably ASCON-128 with p8 constatns, but didn't wrote code yet to decrypt.anyone can help?sampl

Email
Subject
Comment
Verification	Please type the name of the object/variant:
File
Embed
Voice
Poll
Password	(For file deletion.)

Chud 08/15/26 (Sat) 14:26:53 №36403 [Quote]

what happened to my post about reverse engineering encryption algorithm from last day?
i'm sure I posted it, but I can't find it now
i figured that it is probably ASCON-128 with p8 constatns, but didn't wrote code yet to decrypt.
anyone can help?
sample data in attachment
i will update this thread whem I get it decrypted

uint64_t opCode3(uint64_t a, int b) {
return a >> b | a << (-b & 63);
}

void opCode4() {
// calls opCode3 10 times
}

void opCode2() {
// calls opCode4 8 times with constatns 0xb4, 0xa5, 0x96, 0x87 …
}

Chud 08/15/26 (Sat) 14:32:23 №36405 [Quote]

File: opCode3AndStartopCode4.png 📥︎ (321.96 KB, 1591x1048) ImgOps

here is obfuscated code, op code 3 deobfuscated leads to
uint64_t opCode3(uint64_t a, int b) {
return a >> b | a << (-b & 63);
}

Chud 08/15/26 (Sat) 14:46:11 №36406 [Quote]

File: opCode2.png 📥︎ (307.96 KB, 851x919) ImgOps

here is opcode 2 with ascon P8 constants, this is why I think this is ascon, i know there is a lot more of hex values, but these are only values that are not pointer offsets and these are always passed as param12 of function

Chud 08/15/26 (Sat) 17:55:35 №36415 [Quote]

File: obfuscatedFunctions.png 📥︎ (180.44 KB, 917x1049) ImgOps

i got this decrypted, here is JSON data that was in sample file https://anonpaste.com/s/254826f6db
next thing would be figuring out which field corresponds to what

Chud 08/15/26 (Sat) 20:56:14 №36420 [Quote]

File: memoryDump.png 📥︎ (94.13 KB, 556x918) ImgOps

i read process memory after running the code, looks like it is calling a lot of js using eval, here is js code https://anonpaste.com/s/033c992a69

Chud 08/16/26 (Sun) 00:06:30 №36425 [Quote]

this is about integrity right?
it's "Ascon-AEAD128"
also the key changes depending on your headers and ip iirc
either that or it gets shuffled every now and then

Chud 08/16/26 (Sun) 00:19:58 №36428 [Quote]

>>36425
Well we have the aes key

Chud 08/16/26 (Sun) 07:24:02 №36438 [Quote]

>>36425
key changes around 2-3 minutes, I checked with the same browser, same ip, same headers
>>36428
version that is currently used is not using AES, I'm not sure about data from p4 and p6 domains, but data encrypted on browser side is using ascon

Chud 08/16/26 (Sun) 08:10:45 №36440 [Quote]

>>36415
how did you decrypt that?

Chud 08/16/26 (Sun) 08:57:54 №36441 [Quote]

>>36440
code https://anonpaste.com/s/4da95b0128
you will need to change iv, key and data in .c file

Chud 08/16/26 (Sun) 09:02:50 №36442 [Quote]

File: keySetting.png 📥︎ (341.63 KB, 1597x1070) ImgOps

key is in wasm file, always function31 opcode 9
you can also search memory for pattern "21 98 0e 20 20 20 98 0e", it will be near key value

Chud 08/16/26 (Sun) 13:38:16 №36460 [Quote]

This is probably the most intelligent post on the board