Reversing : The Hacker's Guide to Reverse Engineering

into an archive file. Additionally, I would recommend trying out some long
and repetitive password, to try and see if, God forbid, the password is some-
how stored in the file. It also makes sense to quickly scan the file for the origi-
nal name of the encrypted file, to see if Cryptex encrypts the actual file table,
or just the actual file contents. Let’s start out by creating a tiny file called
asterisks.txt, and fill it with a long sequence of asterisks (I created a file
about 1K long). Then proceed to creating a Cryptex archive that contains the
asterisks.txtfile. Let’s use the string 6666666666 as the password.

Cryptex a Test1 6666666666 asterisks.txt

Cryptex provides the following feedback.

Cryptex 1.0 - Written by Eldad Eilam

Archive “Test1.crx” does not exist. Creating a new archive.

Adding file “asterisks.txt” to archive “Test1”.

Encrypting “asterisks.txt” - 100.00 percent completed.

Interestingly, if you check the file size for Test1.crx, it is far larger than
expected, at 8,248 bytes! It looks as if Cryptex archives have quite a bit of
overhead—you’ll soon see why that is. Before actually starting to look inside
the file, let’s ask Cryptex to show its contents, just to see how Cryptex views it.
You can do this using the Lcommand in Cryptex, which lists the files con-
tained in the given archive. Note that Cryptex requires the archive’s password
on every command, including the list command.

Cryptex l Test1 6666666666

Cryptex produces the following output.

Cryptex 1.0 - Written by Eldad Eilam

Listing all files in archive “Test1”.

File Size File Name

3K asterisks.txt

Total files listed: 1 Total size: 3K

There aren’t a whole lot of surprises in this output, but there’s one somewhat
interesting point: the asterisks.txtfile was originally 1K and is shown here
as being 3K long. Why has the file expanded by 2K? Let’s worry about that
later. For now, let’s try one more thing: it is going to be interesting to see how
Cryptex responds when an incorrect password is supplied and whether it
always requires a password, even for a mere file listing. Run Cryptex with the
following command line:

Cryptex l Test1 6666666665

Deciphering File Formats 203