Top Related Projects
RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data
CTF framework and exploit development library
Firmware Analysis Tool
rsatool can be used to calculate RSA and RSA-CRT parameters
Symbolic execution tool
Quick Overview
The xortool
project is a tool for analyzing and cracking XOR-encrypted data. It provides a set of utilities to help identify the key length, as well as potential plaintext and key, for data encrypted using the XOR cipher.
Pros
- Automated Key Length Detection:
xortool
can automatically detect the length of the XOR key used to encrypt the data, which is a crucial first step in cracking the encryption. - Frequency Analysis: The tool performs frequency analysis on the encrypted data, which can provide valuable insights into the potential plaintext and key.
- Multichar Key Support:
xortool
can handle XOR encryption with multi-character keys, not just single-character keys. - Flexible Output: The tool can output the potential plaintext and key in various formats, making it easier to work with the results.
Cons
- Limited to XOR Encryption:
xortool
is specifically designed for XOR encryption and may not be suitable for other types of encryption. - Requires Manual Intervention: While the tool can automate some tasks, it still requires the user to analyze the output and make decisions about the potential plaintext and key.
- Outdated Documentation: The project's documentation may not be up-to-date, which could make it more difficult for new users to get started.
- Lack of Active Maintenance: The project appears to have limited active maintenance, which could impact its long-term viability and compatibility with newer systems.
Code Examples
Since xortool
is a command-line tool and not a code library, there are no code examples to provide.
Getting Started
To get started with xortool
, follow these steps:
-
Install the tool using pip:
pip install xortool
-
Prepare your encrypted data.
xortool
expects the data to be in a file, so you'll need to save the encrypted data to a file. -
Run the
xortool
command to analyze the encrypted data:xortool -f encrypted_data.txt
This will perform the key length detection and frequency analysis, and output the potential plaintext and key.
-
Examine the output and try different approaches to crack the encryption, such as manually inspecting the potential plaintext and key, or using additional tools and techniques.
-
If you need more advanced functionality, you can use the various command-line options provided by
xortool
. For example, you can specify the expected plaintext length, or provide a character frequency file to use for the analysis.xortool -f encrypted_data.txt -l 16 -c freq.txt
That's the basic workflow for using xortool
. Refer to the project's documentation for more detailed instructions and advanced usage examples.
Competitor Comparisons
RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data
Pros of RsaCtfTool
- More comprehensive, targeting RSA cryptography specifically
- Offers a wider range of attack vectors and techniques
- Actively maintained with regular updates
Cons of RsaCtfTool
- More complex to use, requiring deeper understanding of RSA
- Larger codebase, potentially slower for simple XOR operations
- Focused solely on RSA, less versatile for other encryption types
Code Comparison
xortool:
def parse_char(ch):
return ord(ch) if isinstance(ch, str) else ch
def xor(buf, key):
return [parse_char(buf[i]) ^ parse_char(key[i % len(key)]) for i in range(len(buf))]
RsaCtfTool:
def franklin_reiter(self, e, n, c1, c2, a, b):
R.<X> = PolynomialRing(Zmod(n))
f1 = X^e - c1
f2 = (a*X + b)^e - c2
return -composite_gcd(f1,f2).coefficients()[0]
The code snippets highlight the difference in focus: xortool performs simple XOR operations, while RsaCtfTool implements complex RSA-specific algorithms.
CTF framework and exploit development library
Pros of pwntools
- Comprehensive toolkit for CTFs and exploit development
- Extensive documentation and active community support
- Supports multiple architectures and platforms
Cons of pwntools
- Steeper learning curve due to its extensive feature set
- Larger codebase and dependencies
Code comparison
xortool:
def analyze_char_dist(data):
dist = collections.Counter(data)
return dist
pwntools:
from pwn import *
r = remote('example.com', 1337)
r.sendline(b'Hello, World!')
response = r.recvline()
Key differences
- xortool focuses specifically on XOR cipher analysis
- pwntools offers a broader range of tools for various exploitation tasks
- xortool is more lightweight and easier to use for specific XOR-related tasks
- pwntools provides more robust networking and binary analysis capabilities
Use cases
xortool:
- Quick XOR cipher analysis and decryption
- CTF challenges involving simple XOR encryption
pwntools:
- Complex exploit development
- CTF challenges requiring diverse toolsets
- Reverse engineering and binary analysis tasks
Firmware Analysis Tool
Pros of binwalk
- More comprehensive tool for analyzing and extracting firmware images
- Supports a wider range of file formats and embedded systems
- Actively maintained with regular updates and contributions
Cons of binwalk
- Larger and more complex codebase, potentially harder to understand and modify
- May be overkill for simple XOR-based analysis tasks
- Requires more dependencies and system resources
Code comparison
xortool:
def parse_char(ch):
return ord(ch) if isinstance(ch, str) else ch
def xor(buf, key):
return [parse_char(buf[i]) ^ parse_char(key[i % len(key)])
for i in range(len(buf))]
binwalk:
def scan(self, target, offset=0, length=0):
fd = self.config.open_file(target, length=length, offset=offset)
self.offset = offset
self.length = length
self.total_read = 0
self._scan_file(fd)
return self.results
Both tools serve different purposes, with xortool focusing on XOR cipher analysis and binwalk offering broader firmware analysis capabilities. xortool is simpler and more specialized, while binwalk provides a more comprehensive set of features for firmware reverse engineering and analysis.
rsatool can be used to calculate RSA and RSA-CRT parameters
Pros of rsatool
- Focuses specifically on RSA cryptography, offering specialized tools for RSA key manipulation
- Provides functionality to generate RSA keys and perform RSA-related operations
- Useful for cryptographic analysis and security research in RSA contexts
Cons of rsatool
- Limited to RSA-specific operations, lacking versatility for other encryption methods
- May have a steeper learning curve for users unfamiliar with RSA concepts
- Less actively maintained compared to xortool
Code Comparison
xortool:
def analyze_char_frequency(data):
chars_count = defaultdict(int)
for char in data:
chars_count[char] += 1
return chars_count
rsatool:
def generate_prime(bits):
while True:
p = random.getrandbits(bits)
if p % 2 == 0:
p += 1
if gmpy.is_prime(p):
return p
Summary
xortool is a versatile tool for XOR cipher analysis, while rsatool specializes in RSA cryptography. xortool offers broader applicability for various XOR-based encryption scenarios, whereas rsatool provides deeper functionality for RSA-specific tasks. The choice between them depends on the specific cryptographic needs of the user.
Symbolic execution tool
Pros of Manticore
- More comprehensive analysis capabilities, including symbolic execution and formal verification
- Supports multiple architectures (x86, ARM, EVM) and file formats
- Actively maintained with regular updates and a larger community
Cons of Manticore
- Steeper learning curve due to its complexity and broader feature set
- Requires more system resources and may be slower for simple XOR-related tasks
- Not specifically tailored for XOR analysis like xortool
Code Comparison
xortool:
def guess_key_length(data):
# Simple key length guessing based on data patterns
return max(range(1, 65), key=lambda l: count_equals(data, l))
Manticore:
from manticore import Manticore
def analyze_binary(path):
m = Manticore(path)
@m.hook(0x400ca0)
def hook(state):
# Complex symbolic execution and state manipulation
m.run()
Summary
xortool is a specialized tool for XOR-related analysis, offering simplicity and ease of use for specific XOR tasks. Manticore, on the other hand, is a powerful and versatile symbolic execution tool that can handle a wide range of binary analysis tasks, including but not limited to XOR operations. While Manticore provides more comprehensive analysis capabilities, it may be overkill for simple XOR-related tasks where xortool excels.
Convert
designs to code with AI
Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.
Try Visual CopilotREADME
xortool.py
A tool to do some xor analysis:
- guess the key length (based on count of equal chars)
- guess the key (base on knowledge of most frequent char)
Notice: xortool is now only running on Python 3. The old Python 2 version is accessible at the py2
branch. The pip package has been updated.
Installation
$ pip3 install xortool
For development or building this repository, poetry is needed.
poetry build
pip install dist/xortool*.whl
Usage
xortool
A tool to do some xor analysis:
- guess the key length (based on count of equal chars)
- guess the key (base on knowledge of most frequent char)
Usage:
xortool [-x] [-m MAX-LEN] [-f] [-t CHARSET] [FILE]
xortool [-x] [-l LEN] [-c CHAR | -b | -o] [-f] [-t CHARSET] [-p PLAIN] [FILE]
xortool [-x] [-m MAX-LEN| -l LEN] [-c CHAR | -b | -o] [-f] [-t CHARSET] [-p PLAIN] [FILE]
xortool [-h | --help]
xortool --version
Options:
-x --hex input is hex-encoded str
-l LEN, --key-length=LEN length of the key
-m MAX-LEN, --max-keylen=MAX-LEN maximum key length to probe [default: 65]
-c CHAR, --char=CHAR most frequent char (one char or hex code)
-b --brute-chars brute force all possible most frequent chars
-o --brute-printable same as -b but will only check printable chars
-f --filter-output filter outputs based on the charset
-t CHARSET --text-charset=CHARSET target text character set [default: printable]
-p PLAIN --known-plaintext=PLAIN use known plaintext for decoding
-h --help show this help
Notes:
Text character set:
* Pre-defined sets: printable, base32, base64
* Custom sets:
- a: lowercase chars
- A: uppercase chars
- 1: digits
- !: special chars
- *: printable chars
Examples:
xortool file.bin
xortool -l 11 -c 20 file.bin
xortool -x -c ' ' file.hex
xortool -b -f -l 23 -t base64 message.enc
xortool -b -p "xctf{" message.enc
Example 1
# xor is xortool/xortool-xor
tests $ xor -f /bin/ls -s "secret_key" > binary_xored
tests $ xortool binary_xored
The most probable key lengths:
2: 5.0%
5: 8.7%
8: 4.9%
10: 15.4%
12: 4.8%
15: 8.5%
18: 4.8%
20: 15.1%
25: 8.4%
30: 14.9%
Key-length can be 5*n
Most possible char is needed to guess the key!
# 00 is the most frequent byte in binaries
tests $ xortool binary_xored -l 10 -c 00
...
1 possible key(s) of length 10:
secret_key
# decrypted ciphertexts are placed in ./xortool_out/Number_<key repr>
# ( have no better idea )
tests $ md5sum xortool_out/0_secret_key /bin/ls
29942e290876703169e1b614d0b4340a xortool_out/0_secret_key
29942e290876703169e1b614d0b4340a /bin/ls
The most common use is to pass just the encrypted file and the most frequent character (usually 00 for binaries and 20 for text files) - length will be automatically chosen:
tests $ xortool tool_xored -c 20
The most probable key lengths:
2: 5.6%
5: 7.8%
8: 6.0%
10: 11.7%
12: 5.6%
15: 7.6%
20: 19.8%
25: 7.8%
28: 5.7%
30: 11.4%
Key-length can be 5*n
1 possible key(s) of length 20:
an0ther s3cret \xdd key
Here, the key is longer then default 32 limit:
tests $ xortool ls_xored -c 00 -m 64
The most probable key lengths:
3: 3.3%
6: 3.3%
9: 3.3%
11: 7.0%
22: 6.9%
24: 3.3%
27: 3.2%
33: 18.4%
44: 6.8%
55: 6.7%
Key-length can be 3*n
1 possible key(s) of length 33:
really long s3cr3t k3y... PADDING
So, if automated decryption fails, you can calibrate:
- (
-m
) max length to try longer keys - (
-l
) selected length to see some interesting keys - (
-c
) the most frequent char to produce right plaintext
Example 2
We are given a message in encoded in Base64 and XORed with an unknown key.
# xortool message.enc
The most probable key lengths:
2: 12.3%
4: 13.8%
6: 10.5%
8: 11.5%
10: 8.6%
12: 9.4%
14: 7.1%
16: 7.8%
23: 10.4%
46: 8.7%
Key-length can be 4*n
Most possible char is needed to guess the key!
We can now test the key lengths while filtering the outputs so that it only keeps the plaintexts holding the character set of Base64. After trying a few lengths, we come to the right one, which gives only 1 plaintext with a percentage of valid characters above the default threshold of 95%.
$ xortool message.enc -b -f -l 23 -t base64
256 possible key(s) of length 23:
\x01=\x121#"0\x17\x13\t\x7f ,&/\x12s\x114u\x170#
\x00<\x130"#1\x16\x12\x08~!-\'.\x13r\x105t\x161"
\x03?\x103! 2\x15\x11\x0b}".$-\x10q\x136w\x152!
\x02>\x112 !3\x14\x10\n|#/%,\x11p\x127v\x143
\x059\x165\'&4\x13\x17\r{$("+\x16w\x150q\x134\'
...
Found 1 plaintexts with 95.0%+ valid characters
See files filename-key.csv, filename-char_used-perc_valid.csv
By filtering the outputs on the character set of Base64, we directly keep the only solution.
Information
Author: hellman
License: MIT License
Top Related Projects
RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data
CTF framework and exploit development library
Firmware Analysis Tool
rsatool can be used to calculate RSA and RSA-CRT parameters
Symbolic execution tool
Convert
designs to code with AI
Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.
Try Visual Copilot