Tags: crypto xor 

Rating:

The challenge file is named `smokeaway.jpg.enc`, so we can safely assume that it was originally a JPG file. We know it was encrypted using XOR, but we don't know the key, not even its length. Thankfully, we know with a pretty high level of confidence what the JPG headers are:

```
FF D8 FF E8 00 10 4A 46 49 46 00 01 01 00 00 01 00 00 ...
^ ^ ^ ^ ^ ^ ^
```

The bytes I marked with `^` are those I was not entirely sure about, but again, it is with a relatively high level of confidence because it was like that with most of the JPG files I analyzed. If you want more information on JPG headers, please check the dedicated [Wikipedia page](https://en.wikipedia.org/wiki/JPEG_File_Interchange_Format).

Ok so now, assuming the headers of the original JPG are more or less like that, i.e. this is the beginning of the plaintext, we can XOR it with the beginning of the ciphertext to determine the key that was used.

```python
enc_img = []
with open('smokeaway.jpg.enc', 'rb') as f:
byte = f.read(1)
while byte != b'':
enc_img.append(ord(byte))
byte = f.read(1)

key = [0] * 18
key[0] = enc_img[0] ^ 0xff
key[1] = enc_img[1] ^ 0xd8
key[2] = enc_img[2] ^ 0xff
key[3] = enc_img[3] ^ 0xe0
key[4] = enc_img[4] ^ 0x00
key[5] = enc_img[5] ^ 0x10
key[6] = enc_img[6] ^ 0x4a
key[7] = enc_img[7] ^ 0x46
key[8] = enc_img[8] ^ 0x49
key[9] = enc_img[9] ^ 0x46
key[10] = enc_img[10] ^ 0x00
key[11] = enc_img[11] ^ 0x01
key[12] = enc_img[12] ^ 0x01
key[13] = enc_img[13] ^ 0x00
key[14] = enc_img[14] ^ 0x00
key[15] = enc_img[15] ^ 0x01
key[16] = enc_img[16] ^ 0x00
key[17] = enc_img[17] ^ 0x00

print(key)
```

This is the result: `[70, 204, 249, 165, 113, 240, 255, 177, 126, 65, 203, 132, 70, 205, 248, 136, 112, 220]`

We can see that the key bytes start to loop at index 12 (I was a bit wrong in my assumptions so the numbers are not exactly the same afterwards), so we reckon that `key = [70, 204, 249, 165, 113, 240, 255, 177, 126, 65, 203, 132]`.

Finally, we can retrieve the original file by XORing it with the key:

```python
def xor(data, key):
return [data[i] ^ key[i % len(key)] for i in range(len(data))]

with open('smokeaway.jpg', 'wb') as f:
f.write(bytearray(xor(enc_img, key)))
```

![](https://i.imgur.com/6uS3w0om.jpg)