This forum is in archive mode. You will not be able to post new content.

Author Topic: [Python2.7] Hazz15, Zong22, Megan35, Atom128  (Read 1601 times)

0 Members and 1 Guest are viewing this topic.

Offline Deque

  • P.I.N.N.
  • Global Moderator
  • Overlord
  • *
  • Posts: 1203
  • Cookies: 518
  • Programmer, Malware Analyst
    • View Profile
[Python2.7] Hazz15, Zong22, Megan35, Atom128
« on: May 13, 2013, 09:23:10 AM »
You probably already encountered these odd encodings I named in the title.
Searching for algorithms or explanations won't give you much information as they seem to be an invention by a single website: http://crypo.in.ua/tools/eng_atom128d.php

It is amazing how many people use these encodings nevertheless.
I discovered that they are only base64 variants whose characters have been substituted.

Here is a Python 2.7 solution for these encodings. It calculates the base64 string and substitutes the characters afterwards to encode or vice versa to decode.

Code: (python) [Select]
import base64

atom128 = "3GHIJKLMNOPQRSTUb=cdefghijklmnopWXYZ/12+406789VaqrstuvwxyzABCDEF5"
megan35 = "/128GhIoPQROSTeUbADfgHijKLM+n0pFWXY456xyzB7=39VaqrstJklmNuZvwcdEC"
zong22 = "ZKj9n+yf0wDVX1s/5YbdxSo=ILaUpPBCHg8uvNO4klm6iJGhQ7eFrWczAMEq3RTt2"
hazz15 = "HNO4klm6ij9n+J2hyf0gzA8uvwDEq3X1Q7ZKeFrWcVTts/MRGYbdxSo=ILaUpPBC5"
base = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="

class B64VariantEncoder:

    def __init__(self, translation):
        base = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="
        self.lookup = dict(zip(base, translation))
        self.revlookup = dict(zip(translation, base))

    def encode(self, text):
        global lookup
        b64 = base64.b64encode(text)
        result = "".join([self.lookup[x] for x in b64])
        return result

    def decode(self, code):
        global revlookup
        b64 = "".join([self.revlookup[x] for x in code])
        result = base64.b64decode(b64)
        return result   

def encode(variant, text):
    encoder = B64VariantEncoder(variant)
    return encoder.encode(text)

def decode(variant, code):
    try:
        encoder = B64VariantEncoder(variant)
        return encoder.decode(code)
    except KeyError:
        return "no valid encoding"
    except TypeError:
        return "no correct padding"

print "type in your string to encode/decode"
text = raw_input()
print "encode (1) or decode (2)?"
option = raw_input()

if option == "1":
    print "base64:", encode(base, text)
    print "atom128:", encode(atom128, text)
    print "megan35:", encode(megan35, text)
    print "hazz15:", encode(hazz15, text)
    print "zong22:", encode(zong22, text)   
elif option == "2":
    print "base64:", decode(base, text)
    print "atom128:", decode(atom128, text)
    print "megan35:", decode(megan35, text)
    print "hazz15:", decode(hazz15, text)
    print "zong22:", decode(zong22, text)
else:
    print "no valid option"

Note: This is just a source sample and not meant as a full fledged application.
« Last Edit: May 13, 2013, 11:23:48 AM by Kulverstukas »

Offline vezzy

  • Royal Highness
  • ****
  • Posts: 771
  • Cookies: 172
    • View Profile
Re: [Python2.7] Hazz15, Zong22, Megan35, Atom128
« Reply #1 on: May 13, 2013, 06:47:58 PM »
Thanks a bunch for the insight.
Quote from: Dippy hippy
Just brushing though. I will be semi active mainly came to find a HQ botnet, like THOR or just any p2p botnet

Offline Axon

  • VIP
  • King
  • *
  • Posts: 2047
  • Cookies: 319
    • View Profile
Re: [Python2.7] Hazz15, Zong22, Megan35, Atom128
« Reply #2 on: May 13, 2013, 07:47:38 PM »
Actually I've never heard of these encoding up until now, thanks for the delightful information. +1

Offline zoup

  • Serf
  • *
  • Posts: 29
  • Cookies: 3
  • I don't understand anything here !
    • View Profile
Re: [Python2.7] Hazz15, Zong22, Megan35, Atom128
« Reply #3 on: May 17, 2013, 04:40:43 AM »
Didn't know this site thanks for the link and code.

Offline Deque

  • P.I.N.N.
  • Global Moderator
  • Overlord
  • *
  • Posts: 1203
  • Cookies: 518
  • Programmer, Malware Analyst
    • View Profile
Re: [Python2.7] Hazz15, Zong22, Megan35, Atom128
« Reply #4 on: May 17, 2013, 10:08:25 AM »
It wasn't meant as recommendation to use this site, though. It is just some insight into the bullshit they are performing.

 



Want to be here? Contact Ande, Factionwars or Kulverstukas on the forum or at IRC.