📜 ⬆️ ⬇️

How I stopped storing FTP passwords in FAR

Once in my spare time I decided to merge the configs of the worker and home FARs. Having opened both FarSettings.User.reg in WinMerge, spinning the wheel of the mouse languidly, I suddenly caught sight of the familiar ftp-addresses of my accounts on all servers. Seeing them on the screen of a government computer, I felt very uncomfortable. And decided figure out how securely the FTP plugin from FAR stores my passwords.

  1. I create an account, call the host a rare word, so that later it would be easier to search the registry (this is where FAR stores all settings). In my case, this word for some reason became gremlin.
    I put the password - eight ones. It's more convenient for me, they have the ascii code - 0x31 (I will lower the “0x”).
    Dialogue of editing account settings
  2. I open regedit, run a search for the word gremlin, I find.
    Regedit window
  3. I see my eight ones in the Password field (now they are 67). The zero after them tells us that the data is stored as a string (the zero is the end of the string). And this data is encoded . The first two bytes are incomprehensible.
  4. I open the FTP account settings dialog in FAR, do not change anything, save it. The first two bytes have changed, and the byte, replacing the "one".
  5. I put the password "1234", save. The coded sequence takes the form: "89 b2 4a 49 48 4f 00 ..." The monotonicity of the bytes of the password was not preserved, which means that the encoding was not done by addition-subtraction byte-by-by with some constant, but ...
    …Yes. Them. Xor'om. EXCLUSIVE OR. Addition modulo two. The most mysterious operation of all times and peoples. The superalgorithm runs through the password in one byte, xorit them and ... and that's it.
  6. I am gathering statistics, along with a nervous giggle, fussing between themselves the first two mysterious bytes.

    b0^b1 => xorbyte 0d 5d 0e 5e 18 58 30 70 33 73 3b 7b 3f 7f 49 59 53 53 57 57 58 58 69 79 7c 7c 

    ')
    The lower nibble is copied, the older… in short, xorbyte = ((b0 ^ b1) & 0x2f) | 0x50.

Curtain, lonely applause in the dark.

PS The program under Windows and sourcenichki under VisualC .

Source: https://habr.com/ru/post/139955/


All Articles