Tom Butcher
8f2d3a2489
- Created .gitignore to exclude build artifacts and dependencies. - Added package.json and package-lock.json for project dependencies and scripts. - Included pnpm workspace configuration for managing packages. - Implemented TypeScript configuration in tsconfig.json. - Added README.md with project description and usage instructions. - Introduced native code for DES encryption and decryption in C/C++. - Created initial decoded data structure for handling scan results. - Established basic file structure for decoded outputs and native builds.
85 lines
3.5 KiB
JSON
85 lines
3.5 KiB
JSON
{
|
|
"cipher": {
|
|
"mode": "ECB",
|
|
"block_size_bytes": 8,
|
|
"evidence": [
|
|
"A single 8-byte ciphertext (7c1cddebb73720e0) repeats 23,794 times in the tail \u2014 classic ECB encryption of a constant (almost certainly zeros).",
|
|
"The 16-byte view of that pattern is X||X, which rules out AES (16-byte blocks) unless E_k(0) accidentally split into two identical halves (probability ~2^-64).",
|
|
"CBC/CTR/OFB would not emit a long run of one identical block for zero plaintext.",
|
|
"Repeating-XOR with that 8-byte value does not produce a recognizable header, mesh, XML, or image magic, so this is a real 8-byte block cipher (DES, 3DES, Blowfish, CAST, RC2, TEA, \u2026), not XOR."
|
|
],
|
|
"encrypted_zero_ciphertext": "7c1cddebb73720e0",
|
|
"first_8_bytes_ciphertext": "64bf90c5ed6aa99c",
|
|
"tried_and_failed": "Common TechMed / Pectus / MSoft / 3DsizeMe passwords with DES, 3DES, Blowfish, CAST, RC2, TEA, XTEA, and MD5/SHA-derived keys. No key recovered from the file alone."
|
|
},
|
|
"size_hypotheses": [
|
|
{
|
|
"allocation_bytes": 756000,
|
|
"record_bytes": 24,
|
|
"allocated_records": 31500,
|
|
"used_bytes": 565512,
|
|
"used_records": 23563,
|
|
"interpretation": "24-byte vertices (xyz + normal) \u2014 23,563 used of 31,500 reserved. Fits a Structure Sensor torso surface well."
|
|
},
|
|
{
|
|
"allocation_bytes": 756000,
|
|
"record_bytes": 36,
|
|
"allocated_records": 21000,
|
|
"used_bytes": 565512,
|
|
"used_records": null,
|
|
"interpretation": "36-byte vertices (xyz + normal + rgb) \u2014 565512 is not an integer number of 36-byte records, so the used region would need a header or mixed record types."
|
|
},
|
|
{
|
|
"allocation_bytes": 756000,
|
|
"record_bytes": 12,
|
|
"used_records": 47126,
|
|
"interpretation": "xyz-only point cloud, 47,126 points."
|
|
}
|
|
],
|
|
"regions": [
|
|
{
|
|
"name": "encrypted_payload",
|
|
"offset": 0,
|
|
"end": 565512,
|
|
"length": 565512,
|
|
"description": "High-entropy 8-byte ECB ciphertext. Almost every 8-byte block is unique (70686/70689). This is the 3D surface (and likely photos / landmarks / patient fields)."
|
|
},
|
|
{
|
|
"name": "encrypted_zero_block",
|
|
"offset": 565512,
|
|
"end": 565520,
|
|
"length": 8,
|
|
"ciphertext_hex": "7c1cddebb73720e0",
|
|
"description": "Ciphertext of an all-zero (or constant-fill) 8-byte plaintext. Acts as a known ECB pair."
|
|
},
|
|
{
|
|
"name": "encrypted_trailer",
|
|
"offset": 565520,
|
|
"end": 565648,
|
|
"length": 128,
|
|
"description": "16 additional 8-byte ciphertext blocks. Two consecutive blocks at +88/+96 are identical (32232bfa237396b2), so two identical plaintext records sit here. Likely counts, bbox, checksum, or metadata."
|
|
},
|
|
{
|
|
"name": "encrypted_zero_padding",
|
|
"offset": 565648,
|
|
"end": 756000,
|
|
"length": 190352,
|
|
"repeating_block_hex": "7c1cddebb73720e0",
|
|
"repeating_block_count": 23794,
|
|
"description": "Preallocated buffer filled with zeros, then encrypted in 8-byte ECB. Reveals block size and that leftover vertex/face slots were unused."
|
|
},
|
|
{
|
|
"name": "unencrypted_tail_zeros",
|
|
"offset": 756000,
|
|
"end": 756064,
|
|
"length": 64,
|
|
"description": "Raw 64 zero bytes, not passed through the cipher."
|
|
}
|
|
],
|
|
"entropy": {
|
|
"payload_chi_square_vs_uniform": 300.59,
|
|
"payload_chi_square_expected": 255,
|
|
"note": "Byte histogram is nearly flat (counts 2034\u20132342). Consistent with encryption, not raw floats or plaintext mesh."
|
|
}
|
|
}
|