[carlospolop]

Blog URL

https://labs.eye.security/breaking-encryption-schemes-the-lazy-way

Blog Title

Breaking encryption schemes the lazy way

Blog high summary

Reviews DragonForce’s .df_win filename obfuscation: plaintext bytes are lowercase, unpadded Base32-encoded, then transformed through a fixed monoalphabetic 32-symbol table. Known Windows names such as NTUSER.DAT expose mappings; repeated patterns and 6! = 720 ASCII-filtered candidates recover missing entries.

Includes a copy/paste Python PoC with -e, -d, -v, break.txt, round-trip validation, and permutation fallback. The offline attack discloses filename metadata and helps locate proof files, but does not decrypt file contents or recover the ransomware key.

PR changes

• src/crypto/ctf-workflow/README.md: Added known-plaintext recovery and validation of substituted Base32 filenames under the monoalphabetic cipher section.
• src/generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.md: Linked the ransomware analysis section to the canonical filename-recovery workflow.

Errors

mdbook build unavailable

[carlospolop]

Decision: keep

The original research supports the reusable known-plaintext workflow and its limits. The base book covers Base32 and substitution generally, but not this filename-recovery procedure. The forensic link now has its own heading, and both edited pages end with their References sections.

Head: 94cde0506710787037f886e42a650c0c830d0620

[carlospolop]

merge