I need to decrypt an encrypted file with RC4 to answer to a Internet challenge.

The file in question is a dump of a Teensy ROM and it is completely encrypted.

Luckily, it looks like it's a standard Intel HEX format.

For the example, a clear file taken at random:


I can deduce some of the XOR keys used for the first 9 bytes for example (:10000000) but also for all others (:10001000, :10002000, the return characters of each line, ...).

I started with a somewhat generic question because I am not an expert in cryptography about a "bad" implementation of RC4. But we must believe that it was not the right steps.

I tested approaches like bruteforce attack. But with a key of 256 characters apart from making the concatenation of words hoping that the password is formed in this way. But do not appear!

I dropped the "standard" attacks based on WEP/RC4 or SSL/RC4 because I did not find any corelation with my problem.

So, is it possible to decrypt a text encrypt with RC4 without even knowing the encryption key?

Taking into consideration the Intel HEX file format:

  1. characters 0-F this is a .hex
  2. because of its structure, checksum at the end of each line and the normalization of the line break, ...

I have not found much about the possibilities of decrypting a file with RC4 when we know only part of the plaintext.

I do not know if all teensy dumps start with the same 9 first bytes. But the first and the last bytes of each line can be known.

Now is it possible to decipher the rest?

  • $\begingroup$ RC4 has some widely known security flaws. $\endgroup$
    – Elias
    Commented Feb 18, 2018 at 16:34
  • $\begingroup$ I have already looked at all that. I looked at the implementation of FMS and other derivatives of that. I tested some attacks but I did not find anything that matches my problem. So, thank you for this Wikipedia link but I was rather expecting to be directed to a particular algorithm, or an explanation ... $\endgroup$
    – Mekhalleh
    Commented Feb 18, 2018 at 17:24
  • $\begingroup$ Possibly related: RC4 : Keystream reconstruction? $\endgroup$
    – e-sushi
    Commented Feb 18, 2018 at 18:43
  • $\begingroup$ Where does that firmware come from? Is it native to Teensy or was it dumped from something that contained the module? $\endgroup$
    – Mark
    Commented Feb 18, 2018 at 20:25
  • 1
    $\begingroup$ Sorry, but you don't even read the hex file right. The data of the first block is 01C100001DC100001BC1000019C10000. That might be more of a hint - it's rather obviously not random. $\endgroup$
    – Maarten Bodewes
    Commented Feb 19, 2018 at 9:03


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.