3 ms·
The crashplan JARs decompile pretty easily - I had a go a few months ago, and they weren't obfuscated. Highlights: The crypto is pretty bad - it's using blowf
by temp1346 13y ago
The crashplan JARs decompile pretty easily - I had a go a few months ago, and they weren't obfuscated.
Highlights:
The crypto is pretty bad - it's using blowfish in CBC mode with a static IV of 0c22384e5a57412b (convert each byte to decimal...).
The client-server protocol use 32 bit nonces and MACs, which is.
License key validation works by decrypting some packed data from the key after converting the alphabet back to hex. The key is blowfish-cbc encrypted data and the only validation done is verifying the padding - about 1 in 256 randomly generated ones will have valid padding, and the length is not checked.
- teraflop 13y agoWhy on earth would anyone use symmetric crypto for license keys?
- temp1346 13y agoProbably a misguided attempt to keep less data in the database. The key in the client appears to be a test key - verification is server side. The test key: /com/code42/license/LicenseKey.java: private static final byte[] KEY = "Brian in the Conference Room with the Mouse. To be.".getBytes(); I assume this is some inside joke referring to Brian Bispala.
- ballard 13y agoNoice. =) Expounding would kickass, both kinds. ; D
- scott_karana 13y agoThanks! That's really good to know... I assume you're using a temp because of the DMCA?... :(
- temp1346 13y agoBecause possible angry lawyers.