SoScore Mode 0 Password Extractor/Code Snippet (SoCoder)

Created 02 October 2008 | Last Edited 05 October 2008)

SoScore Mode 0 Password Extractor by flying_cucco | No Votes
hack into the (old) scoreboards

As JnK has now posted the updated algorythm, and most games updated, this should be safe to reveal. So, here is a little program that takes a cyphertext message, and its plaintext, and outputs the password.

Input:
coded:string is the cyphertext, which you can get from packet capture or reading the savefile - the longer the better.
plain:string is the plaintext, which must exactly match the contents of the cyphertext, which you can get by looking at the score page.

Some real examples are included at the bottom.

Output:
passwords.csv is a list of possible passwords. 99.99% of the time it will be the first choice.

rainbow.csv is a nice hash table; if you didn't get the plaintext right (so the analysis fails), or are analysing a partial block, the password can probably be guessed from here.

program

const
    BUFFER = 1000                                   

var 
    len         :integer                            //length of string
    //                  index   offset
    plain_asc   :array [BUFFER, BUFFER] of integer  //plain string with rotations
    coded_asc   :array [BUFFER        ] of integer  //clean encrypted string
    delta       :array [BUFFER, BUFFER] of integer  //proposed password hash
    period      :array [        BUFFER] of integer  //number of characters in password

function Hack(plain :string, coded :string) :string
//simple K.P.A
//make tables of possible passwords and return best one
//password should be shorter than the cyphertext
begin

    CreateRainbow(plain, coded)                     //populate table
    SaveRainbow("rainbow.csv")                      //save table
    result := SavePasswords("passwords.csv")        //save passwords

end

procedure CreateRainbow(plain :string, coded :string)
// fill in the data
var    
    index       :integer
    offset      :integer
    
begin
    len := Length(plain)
    
    for index = 0 to len - 1
        coded_asc[index]    := WebDecode( Asc(Mid(coded, index + 1, 1)) )
    next
    
    for index = 0 to len - 1
        for offset = 0 to len - 1
            plain_asc[index, offset] := Asc(Mid(plain, (index + offset) mod len + 1, 1))
            delta[index, offset] := coded_asc[index] - plain_asc[index, offset] + 32
            if delta[index, offset] < 32 then delta[index, offset] := delta[index, offset] + 95
        next 
    next     
    
    for offset = 0 to len - 1
        period[offset] := DeltaPeriod(offset)
    next
end    
    
procedure SaveRainbow(filename :string = "rainbow.csv")
// save csv data table, mostly for debugging
var
    fout        :element
    index       :integer
    offset      :integer
        
begin            
    fout := WriteFile(filename)  

    Write(fout,'"","","period"')
    for offset = 0 to len -1
        Write(fout,',"'+ period[offset] +'"')
    next 
    
    Write(fout, Chr($d) + Chr($a))      
    Write(fout,'"plain","coded","index"') 
    
    for offset = 0 to len -1
        Write(fout,',"'+ offset +'"')
    next   
    
    for index = 0 to len -1 
        Write(fout, Chr($d) + Chr($a))
        Write(fout,'"'+ plain_asc[index, 0] +'","'+ coded_asc[index] +'","'+ index +'"')   
             
        for offset = 0 to len -1
            Write(fout,',"'+ delta[index, offset] +'"')
        next     
        
    next  
    
    Closefile(fout)    
end

function SavePasswords(filename :string = "passwords.csv") :string
// save csv sorted list of passwords
var
    fout        :element
    p, i        :integer
    offset      :integer
    password    :string
        
begin            
    fout := WriteFile(filename)  

    Write(fout,'"offset","length","password"')
    
    for p = 1 to len - 1
        for offset = 0 to len - 1
            if period[offset] = p then
            
                //build password from array 
                password := chr(delta[p-1, offset])
                for i = 0 to p - 2
                    password := password + chr(delta[i, offset]) 
                next 
                
                //return first password
                if result = "" then result := password
                
                //csv safe password
                password := replace(password, '"', '""', false)
                
                //Write to file
                Write(fout, Chr($d) + Chr($a))
                Write(fout,'"'+ offset +'","'+ p +'","'+ password +'"') 
            endif
        next
    next 
    
    Closefile(fout)    
end

function DeltaPeriod(offset :integer) :integer

var
    index   :integer
    p       :integer    
begin

    //make the password the first p characters.
    //check each character matches the password, otherwise increase p and repeat
    for p = 1 to len - 1
        for index = 1 to len - 1
            if delta[index, offset] <> delta[index mod p, offset] then break
            if index = len - 1 then
                result := p
                exit
            endif
        next 
    next
            
end

function WebDecode(ascii :integer) :integer
// reverse websafe encoding
begin
    case ascii of 
    129: result := Asc("&")
    130: result := Asc("?")
    131: result := Asc("+")
    132: result := Asc("\")
    133: result := Asc(":")
    134: result := Asc("/")
    135: result := Asc("#")
    136: result := Asc("'")
    137: result := 34    
    138: result := 32
    139: result := Asc("<")    
    140: result := Asc(">")        
    141: result := Asc("%")
    default: result := ascii 
    endcase
end

var
    plain   :string
    coded   :string 
    
begin
    //example 1 (Cobra Test 2)
//    plain := "cucco3F4E|56160|cucco99BD|52627|cucco1546|48019|cucco99AE|35961|cucco9DF0|33405|cucco3CC6|32851|cucco417C|28449|cucco0F73|24499|cuccoB490|18873|cucco5CDC|17517|"
//    coded := "iHJQ(u}%pv~u(}cEiHJQ$+}tpvzu-}cEiHJQ6x qpu~y+wcEiHJQ)(+%pu}v%{cEiHJQ'+z'py|r*tcEiHJQ-})&pyxw&{cEiHJQ%yzwpx~q%}cEiHJQ-}('pw{z*ucEiHJQ-)-qpwyu$ycEiHJQ'(*wpwxy)ucE"

    //example 2 (Sheriff Munkey)
//    plain := "Nick|2220|Jayenkai|490|cucco|360|N/A|0|N/A|0|N/A|0|N/A|0|N/A|0|N/A|0|N/A|0|N/A|0|N/A|0|N/A|0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0|"
//    coded := "r~hv~rq$jr~hv~rq$jr~hv~rq$jr~hv~rq$jr~hv~rq$jr~hv~rq$jr~hv~rq$jr~hv~rq$jr~hv~rq$jr~hv~rC]Qak},!&q>OoTZeP_q('&kOoRYdp!,~hH}7q$jD}-v~rC#/r~hH}7q$jD}-v~rC#/r~hH}7q$jD}-v~rC#/r~hH}7q$jr~hv~rq$jr~hv~rq$jr~hv~r" 

    //example 3 (Harder H~S)
    plain := "cucco|17988|19|12|Pater-Alf|8707|12|4|Pax|8266|11|8|Pax|7562|10|6|Snappy|5907|8|5|olli|5364|8|6|Jayenkai|4869|8|5|DeanDemon|4788|10|2|Player|4742|10|2|Blanko|4610|9|2|Blanko|4544|9|2|Kango|3564|6|3|N/A|0||0|N/A|0||0|N/A|0||0|N/A|0||0|N/A|0||0|N/A|0||0|N/A|0||0|N/A|0||0|N/A|0||0|N/A|0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0"+"|"+"|0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0||0|"
    coded := '?X/lUTX?U\21@F_(+f, kT?s~*iX\w$&VT@CXl%f=\P1.3/\&$yw)kT?e~*^^Yw$$VV@KE"o5\^V2?VG^$o w#kpQd/Xloyw>}c?S/E o8*1kR?@BE>"+w k?R@`W1oywl~?pRSE of+l=Qc@BEl#fI~0?R@/XlAx<l~??S/v~4f+lkR?@BEl#fw k?R@/Xloywl~??S/E of+lkR?@BEl#fw k?R@/Xloywl~??S/E of+lkR?@BEl#fw k?R@/Xloywl~??S/E of+lkR?@BEl#fw k?R@/Xloywl~??S/E of+lkR?@BEl#fw k?R@/Xloywl~??S/E of+lkR?@BEShM^_kSY\J`l$#w!!?r%'+"'"+'.b +gVkZYSIE!%f/l?$;@JZ&)f,!kZ?ssAl*~1"kSR@HECaKk`h?W\B_l+f0l^//-/]#)}w(kX?msBUaU\YkVZYKE('


    hack(plain, coded)

end

-->

Latest Comments

Posted : Thursday, 02 October 2008, 13:52

Jayenkai

Probably not quite yet, as some folk haven't yet tweaked their programs to fit.
Remember, this isn't just something I did for myself.

You've fucked up everyone elses stuff, too..

Posted : Thursday, 02 October 2008, 15:35

Afr0

Well, the thing about this is that to intercept packets going from any given machine to the Socoder server, you'd have to hack the machine first.
Or the Socoder server, and packetsniff Apache. Which means you'd need to root the box. Good luck with that!
Same thing goes for retrieving save files, really.

Posted : Thursday, 02 October 2008, 16:43

flying_cucco

You don't need to do any of that to give yourself a million points, or whatever.

The first thing I did was let JnK know about the problem, he's not too happy about it though.