DESCracker/decoded/README.md
Tom Butcher 8f2d3a2489 Add initial project structure for DES Key Cracker
- Created .gitignore to exclude build artifacts and dependencies.
- Added package.json and package-lock.json for project dependencies and scripts.
- Included pnpm workspace configuration for managing packages.
- Implemented TypeScript configuration in tsconfig.json.
- Added README.md with project description and usage instructions.
- Introduced native code for DES encryption and decryption in C/C++.
- Created initial decoded data structure for handling scan results.
- Established basic file structure for decoded outputs and native builds.
2026-09-19 16:10:35 +01:00

68 lines
3.2 KiB
Markdown
Raw Permalink Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

# Decoded Pectus Clinic torso scan
Source: `Pectus Clinic - Butcher, Thomas - Torso - Original 20181023, 165650.med`
## What this file is
This is a **TechMed 3D** proprietary `.med` scan (same family as `.iMed` from 3DsizeMe / My3DsizeMe).
The filename and date match **Pectus Scan**, TechMed’s white-label iPad app for Pectus Services (App Store id 1435160086, first shipped 8 October 2018). This capture is from **23 October 2018, 16:56:50** — an original torso scan of **Thomas Butcher**, branded under **Pectus Clinic**.
Capture hardware is an **Occipital Structure Sensor** on an iPad (structured-light surface scan, no X-ray/CT dose). Pectus Services then measured these files in their **T-Scan** tool to plan a T-Joe brace.
Official open exports from MSoft / MSoft+ are STL, OBJ, PLY, VRML, ASCII, and AOP. This `.med` is the locked working copy, not those exports.
## Patient / scan metadata (from the filename)
| Field | Value |
| --- | --- |
| Practice / app brand | Pectus Clinic |
| Patient | Butcher, Thomas |
| Body part | Torso |
| Scan type | Original |
| Timestamp | 2018-10-23 16:56:50 |
TechMed names files:
`{Practice} - {Last}, {First} - {BodyPart} - {ScanType} {YYYYMMDD}, {HHMMSS}.med`
## Binary layout
Total size: **756,064 bytes**.
| Offset | Length | Contents |
| ---: | ---: | --- |
| 0 | 565,512 | Encrypted payload (mesh and other records) |
| 565,512 | 8 | Encrypted zero / fill block `7c1cddebb73720e0` |
| 565,520 | 128 | Encrypted trailer (16 blocks; two identical) |
| 565,648 | 190,352 | Encrypted zero padding (23,794 × the same 8-byte block) |
| 756,000 | 64 | Raw zeros, not encrypted |
The repeating tail is the giveaway: an **8-byte block cipher in ECB mode** encrypting a large preallocated zero buffer. AES is ruled out (16-byte blocks would not produce two identical 8-byte halves). XOR with that block does not reveal STL/OBJ/PLY/XML/JPEG/PNG.
A size that fits the buffer:
- **23,563 × 24-byte vertices** (position + normal) used
- **31,500 × 24-byte slots** allocated (= 756,000 bytes)
That is a plausible Structure Sensor torso cloud/mesh. Photos and landmark/measurement fields that 3DsizeMe normally stores would sit in the same encrypted payload.
## What could not be recovered from the file alone
The mesh coordinates, faces, colour, photos, and any in-file measurements are behind a vendor key that is not stored in the file. Common TechMed / Pectus / MSoft passwords and derived DES/3DES/Blowfish/CAST/TEA keys were tried against the known `E(0) = 7c1cddebb73720e0` pair; none matched.
To get an open 3D file you need one of:
1. **MSoft** (Qwadra / TechMed) — File → Save As → STL / OBJ / PLY. Pay-per-scan tokens exist if you do not have a licence.
2. **Pectus Scan / 3DsizeMe / MSoft+** on the original iPad workflow, if it can re-open this `.med` and export.
3. **Pectus Services T-Scan** or the clinic that took the scan — ask them to re-export STL/OBJ.
Contacts: support@techmed3d.com, info@pectusservices.com.
## Files written here
- `metadata.json` — identity, software, hashes
- `format_layout.json` — region map and cipher notes
- `header_64b.hex.txt` — first 64 ciphertext bytes
- `trailer_128b.hex.txt` — 128-byte trailer dump