Convert Figma logo to code with AI

hellman logoxortool

A tool to analyze multi-byte xor cipher

1,422
176
1,422
6

Top Related Projects

RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data

12,549

CTF framework and exploit development library

12,227

Firmware Analysis Tool

1,304

rsatool can be used to calculate RSA and RSA-CRT parameters

Symbolic execution tool

Quick Overview

The xortool project is a tool for analyzing and cracking XOR-encrypted data. It provides a set of utilities to help identify the key length, as well as potential plaintext and key, for data encrypted using the XOR cipher.

Pros

  • Automated Key Length Detection: xortool can automatically detect the length of the XOR key used to encrypt the data, which is a crucial first step in cracking the encryption.
  • Frequency Analysis: The tool performs frequency analysis on the encrypted data, which can provide valuable insights into the potential plaintext and key.
  • Multichar Key Support: xortool can handle XOR encryption with multi-character keys, not just single-character keys.
  • Flexible Output: The tool can output the potential plaintext and key in various formats, making it easier to work with the results.

Cons

  • Limited to XOR Encryption: xortool is specifically designed for XOR encryption and may not be suitable for other types of encryption.
  • Requires Manual Intervention: While the tool can automate some tasks, it still requires the user to analyze the output and make decisions about the potential plaintext and key.
  • Outdated Documentation: The project's documentation may not be up-to-date, which could make it more difficult for new users to get started.
  • Lack of Active Maintenance: The project appears to have limited active maintenance, which could impact its long-term viability and compatibility with newer systems.

Code Examples

Since xortool is a command-line tool and not a code library, there are no code examples to provide.

Getting Started

To get started with xortool, follow these steps:

  1. Install the tool using pip:

    pip install xortool
    
  2. Prepare your encrypted data. xortool expects the data to be in a file, so you'll need to save the encrypted data to a file.

  3. Run the xortool command to analyze the encrypted data:

    xortool -f encrypted_data.txt
    

    This will perform the key length detection and frequency analysis, and output the potential plaintext and key.

  4. Examine the output and try different approaches to crack the encryption, such as manually inspecting the potential plaintext and key, or using additional tools and techniques.

  5. If you need more advanced functionality, you can use the various command-line options provided by xortool. For example, you can specify the expected plaintext length, or provide a character frequency file to use for the analysis.

    xortool -f encrypted_data.txt -l 16 -c freq.txt
    

That's the basic workflow for using xortool. Refer to the project's documentation for more detailed instructions and advanced usage examples.

Competitor Comparisons

RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data

Pros of RsaCtfTool

  • More comprehensive, targeting RSA cryptography specifically
  • Offers a wider range of attack vectors and techniques
  • Actively maintained with regular updates

Cons of RsaCtfTool

  • More complex to use, requiring deeper understanding of RSA
  • Larger codebase, potentially slower for simple XOR operations
  • Focused solely on RSA, less versatile for other encryption types

Code Comparison

xortool:

def parse_char(ch):
    return ord(ch) if isinstance(ch, str) else ch

def xor(buf, key):
    return [parse_char(buf[i]) ^ parse_char(key[i % len(key)]) for i in range(len(buf))]

RsaCtfTool:

def franklin_reiter(self, e, n, c1, c2, a, b):
    R.<X> = PolynomialRing(Zmod(n))
    f1 = X^e - c1
    f2 = (a*X + b)^e - c2
    return -composite_gcd(f1,f2).coefficients()[0]

The code snippets highlight the difference in focus: xortool performs simple XOR operations, while RsaCtfTool implements complex RSA-specific algorithms.

12,549

CTF framework and exploit development library

Pros of pwntools

  • Comprehensive toolkit for CTFs and exploit development
  • Extensive documentation and active community support
  • Supports multiple architectures and platforms

Cons of pwntools

  • Steeper learning curve due to its extensive feature set
  • Larger codebase and dependencies

Code comparison

xortool:

def analyze_char_dist(data):
    dist = collections.Counter(data)
    return dist

pwntools:

from pwn import *

r = remote('example.com', 1337)
r.sendline(b'Hello, World!')
response = r.recvline()

Key differences

  • xortool focuses specifically on XOR cipher analysis
  • pwntools offers a broader range of tools for various exploitation tasks
  • xortool is more lightweight and easier to use for specific XOR-related tasks
  • pwntools provides more robust networking and binary analysis capabilities

Use cases

xortool:

  • Quick XOR cipher analysis and decryption
  • CTF challenges involving simple XOR encryption

pwntools:

  • Complex exploit development
  • CTF challenges requiring diverse toolsets
  • Reverse engineering and binary analysis tasks
12,227

Firmware Analysis Tool

Pros of binwalk

  • More comprehensive tool for analyzing and extracting firmware images
  • Supports a wider range of file formats and embedded systems
  • Actively maintained with regular updates and contributions

Cons of binwalk

  • Larger and more complex codebase, potentially harder to understand and modify
  • May be overkill for simple XOR-based analysis tasks
  • Requires more dependencies and system resources

Code comparison

xortool:

def parse_char(ch):
    return ord(ch) if isinstance(ch, str) else ch

def xor(buf, key):
    return [parse_char(buf[i]) ^ parse_char(key[i % len(key)])
            for i in range(len(buf))]

binwalk:

def scan(self, target, offset=0, length=0):
    fd = self.config.open_file(target, length=length, offset=offset)
    self.offset = offset
    self.length = length
    self.total_read = 0
    self._scan_file(fd)
    return self.results

Both tools serve different purposes, with xortool focusing on XOR cipher analysis and binwalk offering broader firmware analysis capabilities. xortool is simpler and more specialized, while binwalk provides a more comprehensive set of features for firmware reverse engineering and analysis.

1,304

rsatool can be used to calculate RSA and RSA-CRT parameters

Pros of rsatool

  • Focuses specifically on RSA cryptography, offering specialized tools for RSA key manipulation
  • Provides functionality to generate RSA keys and perform RSA-related operations
  • Useful for cryptographic analysis and security research in RSA contexts

Cons of rsatool

  • Limited to RSA-specific operations, lacking versatility for other encryption methods
  • May have a steeper learning curve for users unfamiliar with RSA concepts
  • Less actively maintained compared to xortool

Code Comparison

xortool:

def analyze_char_frequency(data):
    chars_count = defaultdict(int)
    for char in data:
        chars_count[char] += 1
    return chars_count

rsatool:

def generate_prime(bits):
    while True:
        p = random.getrandbits(bits)
        if p % 2 == 0:
            p += 1
        if gmpy.is_prime(p):
            return p

Summary

xortool is a versatile tool for XOR cipher analysis, while rsatool specializes in RSA cryptography. xortool offers broader applicability for various XOR-based encryption scenarios, whereas rsatool provides deeper functionality for RSA-specific tasks. The choice between them depends on the specific cryptographic needs of the user.

Symbolic execution tool

Pros of Manticore

  • More comprehensive analysis capabilities, including symbolic execution and formal verification
  • Supports multiple architectures (x86, ARM, EVM) and file formats
  • Actively maintained with regular updates and a larger community

Cons of Manticore

  • Steeper learning curve due to its complexity and broader feature set
  • Requires more system resources and may be slower for simple XOR-related tasks
  • Not specifically tailored for XOR analysis like xortool

Code Comparison

xortool:

def guess_key_length(data):
    # Simple key length guessing based on data patterns
    return max(range(1, 65), key=lambda l: count_equals(data, l))

Manticore:

from manticore import Manticore

def analyze_binary(path):
    m = Manticore(path)
    @m.hook(0x400ca0)
    def hook(state):
        # Complex symbolic execution and state manipulation
    m.run()

Summary

xortool is a specialized tool for XOR-related analysis, offering simplicity and ease of use for specific XOR tasks. Manticore, on the other hand, is a powerful and versatile symbolic execution tool that can handle a wide range of binary analysis tasks, including but not limited to XOR operations. While Manticore provides more comprehensive analysis capabilities, it may be overkill for simple XOR-related tasks where xortool excels.

Convert Figma logo designs to code with AI

Visual Copilot

Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.

Try Visual Copilot

README

xortool.py

A tool to do some xor analysis:

  • guess the key length (based on count of equal chars)
  • guess the key (base on knowledge of most frequent char)

Notice: xortool is now only running on Python 3. The old Python 2 version is accessible at the py2 branch. The pip package has been updated.

Installation

$ pip3 install xortool

For development or building this repository, poetry is needed.

poetry build
pip install dist/xortool*.whl

Usage

xortool
  A tool to do some xor analysis:
  - guess the key length (based on count of equal chars)
  - guess the key (base on knowledge of most frequent char)

Usage:
  xortool [-x] [-m MAX-LEN] [-f] [-t CHARSET] [FILE]
  xortool [-x] [-l LEN] [-c CHAR | -b | -o] [-f] [-t CHARSET] [-p PLAIN] [FILE]
  xortool [-x] [-m MAX-LEN| -l LEN] [-c CHAR | -b | -o] [-f] [-t CHARSET] [-p PLAIN] [FILE]
  xortool [-h | --help]
  xortool --version

Options:
  -x --hex                          input is hex-encoded str
  -l LEN, --key-length=LEN          length of the key
  -m MAX-LEN, --max-keylen=MAX-LEN  maximum key length to probe [default: 65]
  -c CHAR, --char=CHAR              most frequent char (one char or hex code)
  -b --brute-chars                  brute force all possible most frequent chars
  -o --brute-printable              same as -b but will only check printable chars
  -f --filter-output                filter outputs based on the charset
  -t CHARSET --text-charset=CHARSET target text character set [default: printable]
  -p PLAIN --known-plaintext=PLAIN  use known plaintext for decoding
  -h --help                         show this help

Notes:
  Text character set:
    * Pre-defined sets: printable, base32, base64
    * Custom sets:
      - a: lowercase chars
      - A: uppercase chars
      - 1: digits
      - !: special chars
      - *: printable chars

Examples:
  xortool file.bin
  xortool -l 11 -c 20 file.bin
  xortool -x -c ' ' file.hex
  xortool -b -f -l 23 -t base64 message.enc
  xortool -b -p "xctf{" message.enc

Example 1

# xor is xortool/xortool-xor
tests $ xor -f /bin/ls -s "secret_key" > binary_xored

tests $ xortool binary_xored
The most probable key lengths:
   2:   5.0%
   5:   8.7%
   8:   4.9%
  10:   15.4%
  12:   4.8%
  15:   8.5%
  18:   4.8%
  20:   15.1%
  25:   8.4%
  30:   14.9%
Key-length can be 5*n
Most possible char is needed to guess the key!

# 00 is the most frequent byte in binaries
tests $ xortool binary_xored -l 10 -c 00
...
1 possible key(s) of length 10:
secret_key

# decrypted ciphertexts are placed in ./xortool_out/Number_<key repr>
# ( have no better idea )
tests $ md5sum xortool_out/0_secret_key /bin/ls
29942e290876703169e1b614d0b4340a  xortool_out/0_secret_key
29942e290876703169e1b614d0b4340a  /bin/ls

The most common use is to pass just the encrypted file and the most frequent character (usually 00 for binaries and 20 for text files) - length will be automatically chosen:

tests $ xortool tool_xored -c 20
The most probable key lengths:
   2:   5.6%
   5:   7.8%
   8:   6.0%
  10:   11.7%
  12:   5.6%
  15:   7.6%
  20:   19.8%
  25:   7.8%
  28:   5.7%
  30:   11.4%
Key-length can be 5*n
1 possible key(s) of length 20:
an0ther s3cret \xdd key

Here, the key is longer then default 32 limit:

tests $ xortool ls_xored -c 00 -m 64
The most probable key lengths:
   3:   3.3%
   6:   3.3%
   9:   3.3%
  11:   7.0%
  22:   6.9%
  24:   3.3%
  27:   3.2%
  33:   18.4%
  44:   6.8%
  55:   6.7%
Key-length can be 3*n
1 possible key(s) of length 33:
really long s3cr3t k3y... PADDING

So, if automated decryption fails, you can calibrate:

  • (-m) max length to try longer keys
  • (-l) selected length to see some interesting keys
  • (-c) the most frequent char to produce right plaintext

Example 2

We are given a message in encoded in Base64 and XORed with an unknown key.

# xortool message.enc
The most probable key lengths:
   2:   12.3%
   4:   13.8%
   6:   10.5%
   8:   11.5%
  10:   8.6%
  12:   9.4%
  14:   7.1%
  16:   7.8%
  23:   10.4%
  46:   8.7%
Key-length can be 4*n
Most possible char is needed to guess the key!

We can now test the key lengths while filtering the outputs so that it only keeps the plaintexts holding the character set of Base64. After trying a few lengths, we come to the right one, which gives only 1 plaintext with a percentage of valid characters above the default threshold of 95%.

$ xortool message.enc -b -f -l 23 -t base64
256 possible key(s) of length 23:
\x01=\x121#"0\x17\x13\t\x7f ,&/\x12s\x114u\x170#
\x00<\x130"#1\x16\x12\x08~!-\'.\x13r\x105t\x161"
\x03?\x103! 2\x15\x11\x0b}".$-\x10q\x136w\x152!
\x02>\x112 !3\x14\x10\n|#/%,\x11p\x127v\x143
\x059\x165\'&4\x13\x17\r{$("+\x16w\x150q\x134\'
...
Found 1 plaintexts with 95.0%+ valid characters
See files filename-key.csv, filename-char_used-perc_valid.csv

By filtering the outputs on the character set of Base64, we directly keep the only solution.

Information

Author: hellman

License: MIT License