2012-12-25

Borderlands 2 serial guessing

A few weeks back i came across this little challenge on TheVamp's blog.
You can see a scratched Borderlands 2 Serial and the task was to find out the correct one and submit it there. After a while i came up with the bash script below. Don't read further if you wanna try it yourself first ; )

1:   #!/bin/bash  
2:   url="http://thevamp.back2hack.cc/challs/borderlands/index.php";  
3:    
4:   block1[0]="B";  
5:   block1[1]="GCQ";  
6:   block1[2]="COQ";  
7:   block1[3]="EFSB";  
8:    
9:   block2[0]="D";  
10:  block2[1]="OQ";  
11:  block2[2]="K";  
12:  block2[3]="A";  
13:    
14:  block3[0]="EFB";  
15:  block3[1]="G";  
16:  block3[2]="B";  
17:  block3[3]="O";  
18:    
19:  block4[0]="F";  
20:  block4[1]="U";  
21:  block4[2]="PRB";  
22:  block4[3]="L";  
23:    
24:  block5[0]="W";  
25:  block5[1]="UO";  
26:  block5[2]="FEB";  
27:  block5[3]="M";  
28:    
29:  block6[0]="B";  
30:  block6[1]="RB";  
31:  block6[2]="Z";  
32:  block6[3]="J";  
33:    
34:  # Total Number of Serials, tns
35:  tns1=`expr ${#block1[0]} \* ${#block1[1]} \* ${#block1[2]} \* ${#block1[3]}`;  
36:  tns2=`expr ${#block2[0]} \* ${#block2[1]} \* ${#block2[2]} \* ${#block2[3]}`;  
37:  tns3=`expr ${#block3[0]} \* ${#block3[1]} \* ${#block3[2]} \* ${#block3[3]}`;  
38:  tns4=`expr ${#block4[0]} \* ${#block4[1]} \* ${#block4[2]} \* ${#block4[3]}`;  
39:  tns5=`expr ${#block5[0]} \* ${#block5[1]} \* ${#block5[2]} \* ${#block5[3]}`;  
40:  tns6=`expr ${#block6[0]} \* ${#block6[1]} \* ${#block6[2]} \* ${#block6[3]}`;  
41:    
42:  tns=`expr $tns1 \* $tns2 \* $tns3 \* $tns4 \* $tns5 \* $tns6`;  
43:  echo "Total number of possible serials: $tns";  
44:    
45:  function createblock(){  
46:      block=("$@");  
47:      for ((b0=0;b0<${#block[0]};b0++))  
48:      do  
49:          for ((b1=0;b1<${#block[1]};b1++))  
50:          do  
51:              for ((b2=0;b2<${#block[2]};b2++))  
52:              do  
53:                  for ((b3=0;b3<${#block[3]};b3++))  
54:                  do  
55:                  bl=${block[0]:b0:1}${block[1]:b1:1}${block[2]:b2:1}${block[3]:b3:1};  
56:                  echo $bl;  
57:                  done  
58:              done  
59:          done  
60:      done  
61:  }  
62:    
63:  function checksearial(){  
64:      key=${serialblock1[b0]}-${serialblock2[b1]}-${serialblock3[b2]}-${serialblock4[b3]}-${serialblock5[b4]}-${serialblock6[b5]};  
65:      request="feld1="${serialblock1[b0]}"&feld2="${serialblock2[b1]}"&feld3="${serialblock3[b2]}"&feld4="${serialblock4[b3]}"&feld5="${serialblock5[b4]}"&feld6="${serialblock6[b5]}"&sub=send";  
66:      result=$(wget --post-data="$request" -qO- /dev/null http://thevamp.back2hack.cc/challs/borderlands/index.php);  
67:      if [[ "$result" != *falsch* ]]  
68:          then  
69:              echo -e "\n[+] FOUND CORRECT SERIAL ";  
70:              echo -e $key "\n";  
71:          exit;  
72:      else  
73:          echo "[*] Testing [$counter|$tns] $key";  
74:          ((counter++));  
75:      fi  
76:  }  
77:    
78:  # Generate all possible serialblocks  
79:  serialblock1+=(`createblock "${block1[@]}"`);  
80:  serialblock2+=(`createblock "${block2[@]}"`);  
81:  serialblock3+=(`createblock "${block3[@]}"`);  
82:  serialblock4+=(`createblock "${block4[@]}"`);  
83:  serialblock5+=(`createblock "${block5[@]}"`);  
84:  serialblock6+=(`createblock "${block6[@]}"`);  
85:    
86:  # Generate all possible serials  
87:  counter=1;  
88:  for ((b0=0;b0<${#serialblock1[@]};b0++))  
89:  do  
90:      for ((b1=0;b1<${#serialblock2[@]};b1++))  
91:      do  
92:          for ((b2=0;b2<${#serialblock3[@]};b2++))  
93:          do  
94:              for ((b3=0;b3<${#serialblock4[@]};b3++))  
95:              do  
96:                  for ((b4=0;b4<${#serialblock5[@]};b4++))  
97:                  do  
98:                      for ((b5=0;b5<${#serialblock6[@]};b5++))  
99:                      do  
100:                          checksearial;  
101:                      done  
102:                  done  
103:              done  
104:          done  
105:      done  
106:  done  
107:    

Line 4-27
6 Arrays, one for each block of the serial and every index got a value of a possible character which i guessed from the picture.

Line 36-40
Calculating all possible serials with the given input.
Example:   _  _  _
                 1  2  3
Position 1: O,C,Q      3
Position 2: A             1
Position 3: I,T           2

All possible values are...
OAI,OAT,CAI,CAT,QAI,QAT  Total of 3*1*2 = 6 possible values

Line 85-87 & 45-61 (createblock)
Creates for every block an array of possible values like the OAI, OAT,CA.... above and stores it in serialblocki

Line 88-106
Does almost the same as createblock but with all seriablocks so a complete serial accrues and calls checkserial

Line 63-76 (checkserial)
wgets the serial to the url and checks if the response has the string "falsch" (wrong) in it. If not so, you found the correct key


I'm sure there is space for optimization in this code but hey it works!
Let me know if you have an better nicer idea to solve that chall.
Thx @TheHaloVamp 4challWozPhun

Useful resources...
http://www.thegeekstuff.com/2010/06/bash-array-tutorial/
http://www.thegeekstuff.com/2010/07/bash-string-manipulation/
http://www.thegeekstuff.com/2011/07/bash-for-loop-examples/
http://www.linuxjournal.com/content/return-values-bash-functions
http://samindaw.wordpress.com/tag/bash-function-pass-array-parameters/
http://stackoverflow.com/questions/1063347/passing-arrays-as-parameters-in-bash
http://wiki.bash-hackers.org/doku.php
http://mywiki.wooledge.org/BashGuide

5 comments:

  1. can you send me the file? i dont know how to save it (*.???) my e-mail is Astorphobis@seznam.cz . Thanks!

    ReplyDelete
    Replies
    1. i am not, please send me the file. I am loser and i dont know how to run it. I have got Windows 8 Enterprise x64 is it working on it?

      Delete
    2. ok sorry, im never sure if it's a bot or not :D... the script above is a linux shell script so it wont work on windoze out of the box.

      Delete
  2. :/ that´s bad :/ can you write something like this in batch? (if you have got skype, add me. my skypename is "molissspetr". thanks.

    ReplyDelete