Post #3922803
2026-07-19 00:05 UTC
8/ two tiers. the old one: a Cython loader running a hand-ported javascript DES (you can tell, the helper fns only exist bc js >>> differs from python). i pulled the whole pipeline out of strings + exports. only missing piece was the key.
#Cython #Ghidra
Replies (1)
-
@NeuroWinter@infosec.exchange 2026-07-19 00:05
9/ almost fell for a red herring, get_key() calls md5 with a tidy 12345678 sitting right beside it. too good to be true. it was. then i remembered it’s just a python module, so i imported it and asked. it handed the key straight over. hardcoded, same 8 bytes in every build.