CRACK Solution

LCG Stream

CRACK LCG keystream XOR cipher

In-game screenshot of LCG Stream
In-game view
FamilyCRACK Graph0.601 DifficultyMedium Ring04 IDz5_lcg_stream

Prerequisites

FOLDED TRIANGLE

Unlocks

TRUNK HUNT

Accepted input LCGKEY1
TechniqueLCG keystream XOR cipher Rulenonzero SampleLCGKEY1

Walkthrough

Recover the accepted input below, then submit it to the CRACK verifier.

Reject Samples

  • LCGKEY2
  • lcgkey1
  • LCGKEY
  • LCGKEY11
  • STREAM7
Verifier Listing
; z5_lcg_stream: LCG keystream XOR cipher. A linear congruential generator
; produces a fresh key byte before every character check: it advances
;   key = (13 * key + 17) mod 256
; from a seed of 0x2A, then XORs the input byte with that key and compares to a
; stored target. Length must be 7. The first seven advanced keys are
;   0x33 0xA8 0x99 0xD6 0xEF 0x34 0xB5
; and XORing them against the targets recovers LCGKEY1. r0 = 1 on accept;
; rule: nonzero.
;
; Maps cleanly to the 8-bit core: the LCG was a mod-256 byte recurrence already,
; and `mul`/`add` wrap mod 256 natively (13*key keeps the low byte, exactly the
; original update). Targets 0x7F 0xEB 0xDE 0x9D 0xAA 0x6D 0x84 of "LCGKEY1".

        len   r2
        cmp   r2, 7
        jnz   bad

        mov   r5, 0x2A      ; r5 = LCG key, seeded
        mov   r7, 0
loop:   cmp   r7, 7
        jge   ok

        ; advance the LCG: key = (13 * key + 17) & 0xFF
        mul   r5, 13
        add   r5, 17

        ldb   r0, [r7]
        xor   r0, r5        ; XOR input with the current keystream byte

        cmp   r7, 0
        jz    t0
        cmp   r7, 1
        jz    t1
        cmp   r7, 2
        jz    t2
        cmp   r7, 3
        jz    t3
        cmp   r7, 4
        jz    t4
        cmp   r7, 5
        jz    t5
        mov   r1, 0x84      ; position 6
        jmp   chk
t0:     mov   r1, 0x7F
        jmp   chk
t1:     mov   r1, 0xEB
        jmp   chk
t2:     mov   r1, 0xDE
        jmp   chk
t3:     mov   r1, 0x9D
        jmp   chk
t4:     mov   r1, 0xAA
        jmp   chk
t5:     mov   r1, 0x6D
chk:    cmp   r0, r1
        jnz   bad
        inc   r7
        jmp   loop

ok:     mov   r0, 1
        ret
bad:    mov   r0, 0
        ret