Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sun, 19 Jul 2020 14:36:52 +0300
From: Aleksey Cherepanov <>
Subject: Re: program to identify hashes in a text file

Johny Krekan <> writes:
> sVid
> I13
> sVlicensor
> I0
> sVsessionKey
> F1594119243.6744404

I don't see any hashes but I noticed other thing here.

All these lines looks like data serialized by "pickle" module of python
2. Python 3 produces binary data because it xores same opcodes with 0x80
to store references. I checked java, dotnet, ruby and php: all of them
uses very different formats.

The reference:

FLOAT           = 'F'   # push float object; decimal string argument
INT             = 'I'   # push integer or bool; decimal string argument
UNICODE         = 'V'   # push Unicode string; raw-unicode-escaped'd argument
PUT             = 'p'   # store stack top in memo; index is string arg
SETITEM         = 's'   # add key+value pair to dict

Opcode 's' picks 2 values from stack and uses them to set field in a
dictionary, so it goes after values in serialized data. Opcode 'V'
pushes unicode string ended with regular end of line, while embedded
ends of line are encoded as unicode escape sequence \u000a.

I added opcode 'p' because python 2.7 puts them after every value. I
don't have other version of python, so I cannot tell if other version
skips them. Yet output looks quite similar.

Example in python:
>>> print pickle.dumps({ u'id' : 13, u'licensor' : 0 })

So in the real data, there is dictionary with keys "id", "licensor",
"sessionKey". I guess there should be more keys, because there should be
a key before the first base64 encoded string. Also there is timestamp
stored as 'float': F1594119243.6744404 (Tue Jul  7 10:54:03 UTC 2020). I
don't see respective key.

The second string encoded in base64 starts with 'V', it should be
pickle's opcode. Then decoded string has a pretty length 256.

Maybe googling the dictionary's keys would point to the framework /
software that produced the data, so it would be possible to read about
the format. But I did not find anything useful.


Aleksey Cherepanov

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.