First up: it's a step in some challenge found on the Internet, where we get an application and a file. The application must be feed with that file and a password (the password is the flag for the challenge).
So, after reversing the application, I found that the algorithm used is RC4 with a small change in the "S" array, which was not initialized to the identity but initialized to $S[i]= 0xFF -i$ .
The information I get from the challenge is that the file once decrypted has the INTEL HEX FORMAT which has a quiet regular format (like the : at each line).
At this point, I get some information about the keystream (i.e a partial keystream). My question is there some relation between the element of the keystream, and is it possible to reconstruct the total keystream from my partial keystream?
All what I found on the RC4 was for attacking WEP, based on the fact that it use the same (IV+key) to encrypt multiple packets, and I don't think it's possible to use this in my case.