Spyke

Replies

linux

Comment on

How would I go about gaining access to a locked-down Linux device I own.

The entries in update.zip are encrypted using the weak ZipCrypto scheme, which is known to be seriously flawed. If you feel motivated, and can guess at least 12 bytes of plaintext for an entry, it is possible to recover the internal state of the generator, which is enough to decipher the data entirely, as well as other entries which were encrypted with the same password. The bkcrack project implements this attack.

Since some of the entries are zip files themselves, it is within the realm of possibility to guess 12 bytes of plaintext. Parts of the zip local file header are pretty static, and you can use some of the values from the local file header of update.zip itself. Still, this would require a bit of luck / inspired guesswork.

firefox

Comment on

Firefox supports loading about:config settings using user.js file that does not support even the basic thing Javascript is supposed to support

https://stackoverflow.com/questions/10602504/how-does-user-js-work-in-firefox-in-detail:

It just looks like a JavaScript file. Once upon a time in Netscape 3 and maybe 4 it actually was, but now it's just a file with a .js extension and a very restricted syntax that's parsed by a separate (non-JS) parser and not executed in any way.

linux

Comment on

How would I go about gaining access to a locked-down Linux device I own.

Reply in thread

The inner zip files are just stored, uncompressed:

Archive: update.zip
Index Encryption Compression CRC32    Uncompressed  Packed size Name
----- ---------- ----------- -------- ------------ ------------ ----------------
    0 ZipCrypto  Store       d1bca061     65761967     65761979 system_lib.zip
    1 ZipCrypto  Deflate     64a3f383         2183          741 config.json
    2 ZipCrypto  Store       3731280f     89300292     89300304 app.zip
    3 ZipCrypto  Store       a2bd64f5    135518964    135518976 app_lib.zip
    4 ZipCrypto  Store       700eb186      5996410      5996422 system.zip

So 12 bytes from the original content.

i2p

Comment on

why do some addresses work while others dont

There is no central naming authority in I2P. All hostnames are local. (Naming and Address Book)

Therefore, if an url doesn't work, it isn't in your local address book.

You can add mappings yourself if you know the destination or b32 address, or make use of subscriptions. In this case, add http://i2p-projekt.i2p/hosts.txt and http://notbob.i2p/hosts.txt to your address book subscriptions, the latter contains the destination for mysu.i2p.