Fravia's Javascript Protection How to use aids from your target :=)	Advanced Javascript
1 February 1998	by Epic Lord
	Courtesy of Fravia's page of reverse engineering	slightly edited by Fravia+
	Epic Lord is a good old +HCU friend, and I'm happy to host his first essay for this section! He did not write the password in this text, assuming that I would have published it on the 'public side', but i decided to publish all 'REAL' solutions on this side... as you can see from this very text, my help has helped people, may be, a little too much. Enjoy! (And please send me a MORE difficult strainer for the next phase if you find one, else I'll have to devise it myself :-)
	There is a crack, a crack in everything That's how the light gets in
Rating	(x)Beginner ( )Intermediate ( )Advanced ( )Expert

	1. Defines a character set, 0..9,A..Z,a..z, 60 chars total, BASE array
	2. Defines a function array, f()
	3. Fills the f() with mathematically defined values as:
		0..9 -> x<<9, +=23
		A..Z -> y<<1, +=(sqrt(y)+5)
		a..z ->	z<<1, +=(sqrt(z)+74)

	4. Sets fraCounter to 4. Only 4 incorrect tries
	5. Asks the password, throws him away if he cancels or exceeds 4 guesses
		BTW, if he cancels, throws him to index.htm
		if he exceeds, to the previous document (history.go(-1))

	6. Gets the variable length password, IGNORING THE FIRST char
		lpass=(pass.length)+1
		this code "ignores.class" tppabs="http://Fravia.org/ignores.class" the  char located at array[0]

	7. If the char is a member of array BASE
		get the numeric values of the char from array f()
		calculate the password_value as
			password_value+=value_of_the_char_from_f()
			password_value*=sequence_number__of_the_pass_char

	8. If the pass is Fravia display a funny message (no no do not display)
		This part of code is commented of the program

	9. If the password_value=25834242042 then go to the protected page
           (i.e. password.htm) 
		else go somewhere else...

	1. Read the help file
	2. Reverse the algorithm. Jean Flynn, has done this for us.
		However, he says he could not find the code. Why?
		BTW, the result is common_sense divisible by 14, 9 and 7. 
		So the code must be 15, 10 or 8 chars long.
		Tristan somehow explained it is 9 chars long (+1 fake char)

	3. Compile and execute the code that Jean Flynn sent.
		BTW, Mr(s) Flynn, a very nice example of recursive programming.
		Though a little slow, it is a cute code :=)

	4. Gee! Millons of combinations. Bad Fravia+. There is more than 1 solution 
           to the problem: 25834242042.

	5. Begin to use your brain. Remember what Fravia+ wrote on his help page
		combinations from axxxxxxxxx to zxxxxxxxxx
		NO numbers in the code
		the last letter is a "r" (like rinaldo) 

	6. Modify Mr Flynn's code so it creates ONLY small letters. Uncomment the line
		return i>=36 ;    // use this to generate only lower case keys
			and commment out
		return 1 ;

	7. Compile and execute the program again. Redirect the output to somewhere
		Fravia.exe > gec.txt

	8. There are only 308 combinations in gec.txt. 
		Now delete the ones without an r at the end.
		Sort the remaining 193 candidates and look for "rav", "ava" ..
			for (f)ravia and/or (j)ava or whatever relevent.

	9. YES. YOU FOUND IT AT LINE 8... Add the obvious prefix and enjoy.

Seems easy ha? It is NOT. Without the help of Fravia+ himself, it would NOT be possible
to crack (or reverse) this kind of protection. Total combinations for 10 characters is
60^10 which is 604,661,760,000,000,000.

Also, what would happen if we would not have been able to see the source code?

This paper is NOT copyrighted or whatsoever. Any part of it can be used for any purpose. 
Epic, epic@lords.com

entrance page	advanced page

---

homepage links anonymity +ORC students' essays academy database
tools Javascript wars cocktails antismut CGI-scripts search_forms mail_Fravia
Is reverse engineering legal?