Need help! Recoveri...
 
Notifications
Clear all

Need help! Recovering scrambled bits!

21 Posts
4 Users
0 Likes
3,116 Views
(@depende)
Posts: 8
Active Member
Topic starter
 

Hi Guys,

I'm trying to solve this problem I got a txt file with scrambled bits which I have to recover so that I can read the plaintext.

These are the scrambled bits
W/5¿Q5;¿-¿=¿%!5¿7=#15!¿'=95¿/=#¿%!¿5!'5¿%=
¿/-#)£¿Q-/¿%!5¿/=#¿!#5¿;-''-!#¿5;-5¿#!¿'--#1¿!#¿/5¿'#5#5¿=#7¿!5¿ŸŸ§ŸŸŸ¿5;-5¿95=57¿7=-'
§¿/5¿-)¿3!%¿'#5=;'5¿-5¿-¿%'-'
-#1£¿m#¿3=9§¿!#5¥/-7¿!3¿/5¿%!¥=33-9)57¿5;-5¿=5¿-)
§¿#5¿55=9/¿/=¿55='57£åëåë£3!5#-9%=1£9!%¿Óš‘¿e=9/¿›Ÿ•åë

I put these bits in a txt file and open it with WinHEX tool. With that tool I've tried to shift one bit to left or to the right and I was unsuccessful. Then I've tried to shift 1, 2, until 10 bits to the left or to the right but I was still unsuccessful. Furthermore, I've tried these functions 'circular left rotation', 'invert bits', 'ROT13', 'XOR 1,2', 'OR 1,2', 'AND 1,2' but I was still unsuccessful.

Do I need to use may another tool? Do I have to try the function with 'Shift by .. byte(s)' until I'm successful?

Do you any better ideas?

Thanks in advance!

 
Posted : 17/04/2015 5:03 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Hi Guys,

I'm trying to solve this problem I got a txt file with scrambled bits which I have to recover so that I can read the plaintext.

Is this a "real problem"?
I mean, in the sense that you are doing data recovery or similar?
Or is it a school/UNI assignment?
Or what?

What is the source of this?
How did it came to you?
Why are you trying to descramble it?
How do you know that the "scrambled bits" correspond to plain text?

Etc., etc.

The more context you provide the more likely that someonw will be able to assist you or at least hint towards a suitable descrambling procedure.

BTW, what you posted makes NO sense whatsoever, in the sense that it is the graphical representation as text of the "scrambled bits", what you need to do is to compress the actual binary file into a .zip or similar archive, upload the archive to any free hosting site and provide a link to it.

jaclaz

 
Posted : 17/04/2015 5:13 pm
(@depende)
Posts: 8
Active Member
Topic starter
 

Hi jaclaz,

It's not real problem, it's an assignment because I'm studying digital forensic. Unfortunately, our lecturer reads only from the slides and has itself no idea…every step we have to find it by ourselves which is time consuming if you are working besides your study.

These are the scrambled bits which I have copied from the txt file
W/5¿Q5;¿-¿=¿%!5¿7=#15!¿'=95¿/=#¿%!¿5!'5¿%=
¿/-#)£¿Q-/¿%!5¿/=#¿!#5¿;-''-!#¿5;-5¿#!¿'--#1¿!#¿/5¿'#5#5¿=#7¿!5¿ŸŸ§ŸŸŸ¿5;-5¿95=57¿7=-'
§¿/5¿-)¿3!%¿'#5=;'5¿-5¿-¿%'-'
-#1£¿m#¿3=9§¿!#5¥/-7¿!3¿/5¿%!¥=33-9)57¿5;-5¿=5¿-)
§¿#5¿55=9/¿/=¿55='57£åëåë£3!5#-9%=1£9!%¿Óš‘¿e=9/¿›Ÿ•åë

If you copy these scrambled bits and paste it in a txt file, you can then open that file in a tool like WinHex or Hex Workshop. I'm trying since 2 days with both tools to get any results about the original order of the plain text but I'm unsuccessful. I really don't what I have to do…
In Hex Workshop, I've tried with shift left, shift right, rotate left, rotate right, block shift left, block shift right, change sign and so on, but the text is still scrambled.

Thanks in advance for any hints, tips!!!!

 
Posted : 17/04/2015 5:35 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

If you copy these scrambled bits and paste it in a txt file, you can then open that file in a tool like WinHex or Hex Workshop.

NO.

Meaning that what you copy and paste to a .txt file you are NOT opening the "scrambled bits", but a copy of the TEXTUAL REPRESENTATION of the original.

If you want help/support you need to provide the ACTUAL bits, and NOT a copy/paste of them gone through a text editor.

As an example, a LARGE number of NON PRINTABLE characters may be rendered as "a small square" and even the SAME text editor may interpret them differently with different local settings, fonts and what not.

Is there any difficult part in this?

what you need to do is to compress the actual binary file into a .zip or similar archive, upload the archive to any free hosting site and provide a link to it.

jaclaz

 
Posted : 17/04/2015 5:52 pm
(@depende)
Posts: 8
Active Member
Topic starter
 

ok,

this is the link where you can download that file

http//www.freeuploadsite.com/do.php?id=69467

Thanks for any feedback!

 
Posted : 17/04/2015 6:13 pm
PaulSanderson
(@paulsanderson)
Posts: 651
Honorable Member
 

Without doing your assignment for you - I would probably start by looking for patterns in the hex of the sample you provide viz hex in a sample of plain text.

You can spend an age trying different bit shifts/rotates etc. but if you have an idea of what a particular character might be you can start making informed 'guesses'

 
Posted : 17/04/2015 7:09 pm
(@depende)
Posts: 8
Active Member
Topic starter
 

Without doing your assignment for you - I would probably start by looking for patterns in the hex of the sample you provide viz hex in a sample of plain text.

You can spend an age trying different bit shifts/rotates etc. but if you have an idea of what a particular character might be you can start making informed 'guesses'

Hi Paul,

The idea of my post isn't that somebody has to do my assignment. I need somebody that guide me a bit.

What do you mean 'start looking by patterns in the hex'?
For example, if I'm looking at the first raw, I see in the column 2,5,10 and 16 the number 35 four times or in the column 3, 7,A, C and 11 the letters BF. So what that means? How it helps me to solve this case?

Thanks!

 
Posted : 17/04/2015 7:38 pm
PaulSanderson
(@paulsanderson)
Posts: 651
Honorable Member
 

I am trying to help you - but I (and jaclaz) are trying to make you think about it and not explain it to you in minute detail.

Have you looked at the hex of a text file with known content as I suggested in my last post?

If you understand the patterns of hex in a clear text file then you may start to get an idea of where to look next.

 
Posted : 17/04/2015 7:42 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

More generally, assuming that the original text
1) was written into a known human language (let's say English)
2) the sentences have actually a meaning (i.e. let's say that it is NOT the laundry note)

there are definite "patterns" and "frequencies" of characters.
http//en.wikipedia.org/wiki/Letter_frequency

Winhex (among other hex editors) have a nice histogram tool to quickly check frequences of hex values in a binary file, but you can as well use the freeware HxD or even (shameless plug wink ) an Excel worksheet
http//www.msfn.org/board/topic/173080-release-byte-count-in-excel/

Analyzing these frequencies sometimes helps in understanding if there has been some kind of "shift" applied.

jaclaz

 
Posted : 17/04/2015 9:01 pm
(@depende)
Posts: 8
Active Member
Topic starter
 

Thank you guys for your input but I've still not solved this problem.

When I'm opening the that file in Winhex I can see this text
W/5.Q5;.-..=.%!.5.7=#15.!….'=95../=#.%!….5!.'5.%=…/-#)..Q-./.%!.5../=#.!#5.;-''-!#..5;.-.5..#!..'-.-#1.!#../5.'#.5.#5..=#7.!.5………..5;.-.5..9.5=.57.7=-'…./5..-.).3.!%…'#5.=;'5..-.5..-..%.'.-.'.-#1..m#.3=9…!#5../-.7.!3../5.%!…..=33-9)57..5;.-.5..=.5..-.)…#5…5.5=.9/./=…5.5='57………3!.5#.-9%=1.9!%…..e=.9/…….

Then I've opened another file with known content and started to compare both files.

Ok, in the file with the scrambled bits I can see the letter W which has the hex code 57 compared to the known content file which the letter W has the hex code 77. If I change the hex code to 77 in scrambled bits file, it only change w to W.

Furthermore, I've tried that byte count excel file. I can see for example in Byte 21, Count 16, Printable 16, ^!, is 4.75% or in Byte 35, Count 36, Printable 36, ^5, is 10.68%. Now I know which signs are more common but how I connect these all information to solve this case?

I understand that each hex code equal a letter or number but I don't understand looking at patterns that should give a clue how the original file should be….I'm really confused at the moment.

 
Posted : 18/04/2015 7:05 am
Page 1 / 3
Share: