Showing posts with label airec01f. Show all posts
Showing posts with label airec01f. Show all posts

Friday, March 4, 2011

Aluratek AIREC01F #10

So let's look at the offsets found in episode 8. We'll see that most blocks are of length 16384 (which is 2^14). Those in which we find the strange 34 byte signature (beginning with ALT7021) have a strange length.

Notice that there is a clear-text XML file spanning over 2 blocks.

----
0x00-0x1f     : strange 32 byte signature
0x20-0x7f     : some kind of header ? (96 bytes)
0x80-0x4016   : data
0x4017-0x401f : repeated 0x20 bytes

$ echo $((0x401f - 0x20 + 1))
16384
----
0x4020-0x403f : strange 32 byte signature
0x4040-0x7257 : data
0x7258-0x803f : repeated 0x20 bytes

$ echo $((0x803f - 0x4040 + 1))
16384
----
0x8040-0x805f : strange 32 byte signature
0x8060-0x81d0 : repeated 0x20 bytes
0x81d1-0x81f2 : strange 34 byte signature

$ echo $((0x81f2 - 0x8060 + 1))
403
----
0x81f3-0x8212 : strange 32 byte signature
0x8213-0x9fee : data
0x9fef-0xa212 : repeated 0xFF bytes
0xa213-0xa492 : data
0xa493-0xc212 : repeated 0x00 bytes

$ echo $((0xc212 - 0x8213 + 1))
16384
----
0xc213-0xc232  : strange 32 byte signature
0xc233-0x10232 : repeated 0x00 bytes

$ echo $((0x10232 - 0xc233 + 1))
16384
----
0x10233-0x10252 : strange 32 byte signature
0x10253-0x10f32 : repeated 0x00 bytes

$ echo $((0x10f32 - 0x10253 + 1))
3296
----
0x10f55-0x10f74 : strange 32 byte signature
0x10f75-0x12f86 : data
0x12f87-0x14f74 : repeated 0xFF bytes

$ echo $((0x14f74 - 0x10f75 + 1))
16384
----
0x14f75-0x14f94 : strange 32 byte signature
0x14f95-0x18f94 : repeated 0xFF bytes

$ echo $((0x18f94 - 0x14f95 + 1))
16384
----
0x18f95-0x18fb4 : strange 32 byte signature
0x18fb5-0x1cfb4 : data

$ echo $((0x1cfb4 - 0x18fb5 + 1))
16384
----
0x1cfb5-0x1cfd4 : strange 32 byte signature
0x1cfd5-0x1dc54 : data
0x1dc55-0x20fd4 : repeated 0xFF bytes

$ echo $((0x20fd4 - 0x1cfd5 + 1))
16384
----
0x20fd5-0x20ff4 : strange 32 byte signature
0x20ff5-0x5146f : data
0x21470-0x24ff4 : repeated 0xFF bytes

$ echo $((0x24ff4 - 0x20ff5 + 1))
16384
----
0x24ff5-0x25014 : strange 32 byte signature
0x25015-0x29014 : repeated 0xFF bytes

$ echo $((0x29014 - 0x25015 + 1))
16384
----
0x29015-0x29034 : strange 32 byte signature
0x29035-0x2d034 : data

$ echo $((0x2d034-0x29035 + 1))
16384
----
This one is funny because it's in the middle of an XML file :)

0x2d035-0x2d054 : strange 32 byte signature
0x2d055-0x2f066 : data
0x2f067-0x2f088 : strange 34 byte signature

$ echo $((0x2f088 - 0x2d055 + 1))
8244
----
0x2f089-0x2f0a8 : strange 32 byte signature
0x2f0a9-0x330a8 : data

$ echo $((0x330a8 - 0x2f0a9 + 1))
16384
----
0x330a9-0x330c8 : strange 32 byte signature
0x330c9-0x34018 : data
0x34019-0x3403a : strange 34 byte signature

$ echo $((0x3403a - 0x330c9 + 1))
3954
----
0x3403b-0x3405a : strange 32 byte signature

[...]


----
0x8029b-0x802ba : strange 32 byte signature
0x802bb-0x83c0d : data
0x83c0e-0x83c2f : strange 34 byte signature

$ echo $((0x83c2f - 0x802bb + 1))
14709
----
0x83c30-0x83c4f : strange 32 byte signature
0x83c50-0x8551b : data
0x8551c-0x85c4b : repeated 0x00 bytes
0x85c4c-0x85c4f : 00 03 50 6D
0x85c50-0x8751c : data
0x8751d-0x87c4b : repeated 0x00 bytes
0x87c4c-0x87c4f : 00 03 50 6D

$ echo $((0x87c4f - 0x83c50 + 1))
16384
----
0x87c50-0x87c6f : strange 32 byte signature
0x87c70-0x8bc6f : repeated 0xFF bytes

$ echo $((0x8bc6f - 0x87c70 + 1))
16384
----
0x8bc70-0x8bc8f : strange 32 byte signature
0x8bc90-0x8bccd7 : data
0x8bccd8-0x8dc8f : repeated 0xFF bytes

$ echo $((0x8dc8f - 0x8bc90 + 1))
8192
----
0x8fc90-0x8fcaf : strange 32 byte signature
0x8fcb0-0x90be6 : data
0x90be7-0x90fbf : repeated 0xFF bytes
0x90fc0-0x90fe1 : strange 34 byte signature (ALT7021...)

----

And this is the end of the firmware.

Thursday, March 3, 2011

Aluratek AIREC01F #9

So according to episode 6 we have Blowfish tables from 0x0008bc90 to 0x0008ccd8 + 1024 - 1 = 0x0008ccd7 (included).

After that, from 0x0008ccd8 to 0x0008dc8f we have repeated 0xFF bytes.

And before that, we have our strange 32 byte signature found in episode 7 from 0x0008bc70 to 0x0008bc8f.

(And even before, there's a lot of repeated 0xFF bytes also.)

We can notice something:

$ echo $((0x8dc8f - 0x8bc90 + 1))
8192

There is some padding to 8192 bytes (2^13) with 0xFF.

We also have our strange 32 byte signature at 0x00087c50, and then repeated 0xFF from 0x00087c70 to 0x0008bc6f (included).

$ echo $((0x8bc6f - 0x87c70 + 1))
16384

There is also some padding to 16384 bytes (2^14) with 0xFF.

Aluratek AIREC01F #8

Let's make a small script to try to understand what we have found in episode 7:

#!/bin/sh

LIST="0x00000000 0x00004020 0x00008040 0x000081f3 0x0000c213 0x00010233 0x00010f55 0x00014f75 0x00018f95 0x0001cfb5 0x00020fd5 0x00024ff5 0x00029015 0x0002d035 0x0002f089 0x000330a9 0x0003403b 0x0003805b 0x0003c07b 0x0004009b 0x000440bb 0x000480db 0x0004c0fb 0x0005011b 0x0005413b 0x0005815b 0x0005c17b 0x0006019b 0x000641bb 0x000681db 0x0006c1fb 0x0007021b 0x0007423b 0x0007825b 0x0007c27b 0x0008029b 0x00083c30 0x00087c50 0x0008bc70 0x0008fc90"

for addr in $LIST
do
    hd -s $(($addr)) -n 32 $1 | head -n 2
    printf "\n"
done

And here's what it displays:

$ ./list.sh ShrekW.BIN
00000000 be d9 ea 39 fc fe ff ff ff ff ff ff ff ff 6f ff |ŸÙê9üþÿÿÿÿÿÿÿÿoÿ|
00000010 fd ff f7 ff ff ff ff ff ff 3a 6f ff 1f f7 91 16 |ýÿ÷ÿÿÿÿÿÿ:oÿ.÷..|

00004020 be 59 ea 39 fc fe ff ff ff ff ef ff ff ff 6f ff |ŸYê9üþÿÿÿÿïÿÿÿoÿ|
00004030 fd ff ff ff ff ff ff e1 ff 3a 6f ff 1f f7 a0 56 |ýÿÿÿÿÿÿáÿ:oÿ.÷ V|

00008040 be d9 ea 39 fc fe fb 1d ff ff df ff ff ff 6f ff |ŸÙê9üþû.ÿÿßÿÿÿoÿ|
00008050 fd ff ff ff ff ff ff e1 ff 3b 6f ff 1f f7 d8 57 |ýÿÿÿÿÿÿáÿ;oÿ.÷ØW|

000081f3 be 59 ea 19 fc fe ff ff ff ff ff ff ff ff 6f ff |ŸYê.üþÿÿÿÿÿÿÿÿoÿ|
00008203 fd ff f7 ff ff ff ff ff ff 3a 6f ff 1f f7 92 16 |ýÿ÷ÿÿÿÿÿÿ:oÿ.÷..|

0000c213 be d9 ea 19 fc fe ff ff ff ff ef ff ff ff 6f ff |ŸÙê.üþÿÿÿÿïÿÿÿoÿ|
0000c223 fd ff ff ff ff ff ff e1 ff 3a 6f ff 1f f7 a0 56 |ýÿÿÿÿÿÿáÿ:oÿ.÷ V|

00010233 be d9 ea 19 fc fe cf 3f ff ff df ff ff ff 6f ff |ŸÙê.üþÏ?ÿÿßÿÿÿoÿ|
00010243 fd ff ff ff ff ff ff e1 fe 3b 6f ff 1f f7 90 63 |ýÿÿÿÿÿÿáþ;oÿ.÷.c|

00010f55 be 59 ea f9 fc fe ff ff ff fc ff ff ff ff 6f ff |ŸYêùüþÿÿÿüÿÿÿÿoÿ|
00010f65 fd ff ff 9f ff ff ff ff ff 3a 6f ff 1f f7 91 1c |ýÿÿ.ÿÿÿÿÿ:oÿ.÷..|

00014f75 be 59 ea f9 fc fe ff ff ff fc ef ff ff ff 6f ff |ŸYêùüþÿÿÿüïÿÿÿoÿ|
00014f85 fd ff ff ff ff ff ff e1 ff 3a 6f ff 1f f7 a0 56 |ýÿÿÿÿÿÿáÿ:oÿ.÷ V|

00018f95 be 59 ea f9 fc fe ff ff ff fc df ff ff ff 6f ff |ŸYêùüþÿÿÿüßÿÿÿoÿ|
00018fa5 fd ff ff ff ff ff ff e1 ff 3a 6f ff 1f f7 a0 96 |ýÿÿÿÿÿÿáÿ:oÿ.÷ .|

0001cfb5 be 59 ea f9 fc fe ff ff ff fc cf ff ff ff 6f ff |ŸYêùüþÿÿÿüÏÿÿÿoÿ|
0001cfc5 fd ff ff ff ff ff ff e1 ff 3a 6f ff 1f f7 a0 d6 |ýÿÿÿÿÿÿáÿ:oÿ.÷ Ö|

00020fd5 be d9 ea f9 fc fe ff ff ff fc ff ff ff ff 6f ff |ŸÙêùüþÿÿÿüÿÿÿÿoÿ|
00020fe5 fd ff ff ff ff ff 7f e1 ff 3a 6f ff 1f f7 a0 16 |ýÿÿÿÿÿ.áÿ:oÿ.÷ .|

00024ff5 be d9 ea f9 fc fe ff ff ff fc ef ff ff ff 6f ff |ŸÙêùüþÿÿÿüïÿÿÿoÿ|
00025005 fd ff ff ff ff ff 7f e1 ff 3a 6f ff 1f f7 a0 56 |ýÿÿÿÿÿ.áÿ:oÿ.÷ V|

00029015 be d9 ea f9 fc fe ff ff ff fc df ff ff ff 6f ff |ŸÙêùüþÿÿÿüßÿÿÿoÿ|
00029025 fd ff ff ff ff ff 7f e1 ff 3a 6f ff 1f f7 a0 96 |ýÿÿÿÿÿ.áÿ:oÿ.÷ .|

0002d035 be d9 ea f9 fc fe 7f db ff fc cf ff ff ff 6f ff |ŸÙêùüþ.ÛÿüÏÿÿÿoÿ|
0002d045 fd ff ff ff ff ff 7f e1 ff 3b 6f ff 1f f7 a9 b6 |ýÿÿÿÿÿ.áÿ;oÿ.÷©¶|

0002f089 be 59 ea 59 fc fe ff ff ff ff ff ff ff ff 6f ff |ŸYêYüþÿÿÿÿÿÿÿÿoÿ|
0002f099 fd ff f7 ff ff ff ff ff ff 3a 6f ff 1f f7 91 16 |ýÿ÷ÿÿÿÿÿÿ:oÿ.÷..|

000330a9 be d9 ea 59 fc fe c3 5f ff ff ef ff ff ff 6f ff |ŸÙêYüþÃ_ÿÿïÿÿÿoÿ|
000330b9 fd ff ff ff ff ff ff e1 ff 3b 6f ff 1f f7 c7 25 |ýÿÿÿÿÿÿáÿ;oÿ.÷Ç%|

0003403b be d9 ea f9 fc fe ff ff ff ff ff ff ff f8 6f ff |ŸÙêùüþÿÿÿÿÿÿÿøoÿ|
0003404b fd ff 07 ff ff ff ff ff ff 3a 6f ff 1f f7 8d 17 |ýÿ.ÿÿÿÿÿÿ:oÿ.÷..|

0003805b be 59 ea f9 fc fe ff ff ff ff ef ff ff ff 6f ff |ŸYêùüþÿÿÿÿïÿÿÿoÿ|
0003806b fd ff ff ff ff ff ff e1 ff 3a 6f ff 1f f7 9d 56 |ýÿÿÿÿÿÿáÿ:oÿ.÷.V|

0003c07b be 59 ea f9 fc fe ff ff ff ff df ff ff ff 6f ff |ŸYêùüþÿÿÿÿßÿÿÿoÿ|
0003c08b fd ff ff ff ff ff ff e1 ff 3a 6f ff 1f f7 9d 96 |ýÿÿÿÿÿÿáÿ:oÿ.÷..|

0004009b be 59 ea f9 fc fe ff ff ff ff cf ff ff ff 6f ff |ŸYêùüþÿÿÿÿÏÿÿÿoÿ|
000400ab fd ff ff ff ff ff ff e1 ff 3a 6f ff 1f f7 9d d6 |ýÿÿÿÿÿÿáÿ:oÿ.÷.Ö|

000440bb be d9 ea f9 fc fe ff ff ff ff ff ff ff ff 6f ff |ŸÙêùüþÿÿÿÿÿÿÿÿoÿ|
000440cb fd ff ff ff ff ff 7f e1 ff 3a 6f ff 1f f7 9d 16 |ýÿÿÿÿÿ.áÿ:oÿ.÷..|

000480db be d9 ea f9 fc fe ff ff ff ff ef ff ff ff 6f ff |ŸÙêùüþÿÿÿÿïÿÿÿoÿ|
000480eb fd ff ff ff ff ff 7f e1 ff 3a 6f ff 1f f7 9d 56 |ýÿÿÿÿÿ.áÿ:oÿ.÷.V|

0004c0fb be d9 ea f9 fc fe ff ff ff ff df ff ff ff 6f ff |ŸÙêùüþÿÿÿÿßÿÿÿoÿ|
0004c10b fd ff ff ff ff ff 7f e1 ff 3a 6f ff 1f f7 9d 96 |ýÿÿÿÿÿ.áÿ:oÿ.÷..|

0005011b be d9 ea f9 fc fe ff ff ff ff cf ff ff ff 6f ff |ŸÙêùüþÿÿÿÿÏÿÿÿoÿ|
0005012b fd ff ff ff ff ff 7f e1 ff 3a 6f ff 1f f7 9d d6 |ýÿÿÿÿÿ.áÿ:oÿ.÷.Ö|

0005413b be 59 ea f9 fc fe ff ff ff fe ff ff ff ff 6f ff |ŸYêùüþÿÿÿþÿÿÿÿoÿ|
0005414b fd ff ff ff ff ff ff e1 ff 3a 6f ff 1f f7 9e 16 |ýÿÿÿÿÿÿáÿ:oÿ.÷..|

0005815b be 59 ea f9 fc fe ff ff ff fe ef ff ff ff 6f ff |ŸYêùüþÿÿÿþïÿÿÿoÿ|
0005816b fd ff ff ff ff ff ff e1 ff 3a 6f ff 1f f7 9e 56 |ýÿÿÿÿÿÿáÿ:oÿ.÷.V|

0005c17b be 59 ea f9 fc fe ff ff ff fe df ff ff ff 6f ff |ŸYêùüþÿÿÿþßÿÿÿoÿ|
0005c18b fd ff ff ff ff ff ff e1 ff 3a 6f ff 1f f7 9e 96 |ýÿÿÿÿÿÿáÿ:oÿ.÷..|

0006019b be 59 ea f9 fc fe ff ff ff fe cf ff ff ff 6f ff |ŸYêùüþÿÿÿþÏÿÿÿoÿ|
000601ab fd ff ff ff ff ff ff e1 ff 3a 6f ff 1f f7 9e d6 |ýÿÿÿÿÿÿáÿ:oÿ.÷.Ö|

000641bb be d9 ea f9 fc fe ff ff ff fe ff ff ff ff 6f ff |ŸÙêùüþÿÿÿþÿÿÿÿoÿ|
000641cb fd ff ff ff ff ff 7f e1 ff 3a 6f ff 1f f7 9e 16 |ýÿÿÿÿÿ.áÿ:oÿ.÷..|

000681db be d9 ea f9 fc fe ff ff ff fe ef ff ff ff 6f ff |ŸÙêùüþÿÿÿþïÿÿÿoÿ|
000681eb fd ff ff ff ff ff 7f e1 ff 3a 6f ff 1f f7 9e 56 |ýÿÿÿÿÿ.áÿ:oÿ.÷.V|

0006c1fb be d9 ea f9 fc fe ff ff ff fe df ff ff ff 6f ff |ŸÙêùüþÿÿÿþßÿÿÿoÿ|
0006c20b fd ff ff ff ff ff 7f e1 ff 3a 6f ff 1f f7 9e 96 |ýÿÿÿÿÿ.áÿ:oÿ.÷..|

0007021b be d9 ea f9 fc fe ff ff ff fe cf ff ff ff 6f ff |ŸÙêùüþÿÿÿþÏÿÿÿoÿ|
0007022b fd ff ff ff ff ff 7f e1 ff 3a 6f ff 1f f7 9e d6 |ýÿÿÿÿÿ.áÿ:oÿ.÷.Ö|

0007423b be 59 ea f9 fc fe ff ff ff fd ff ff ff ff 6f ff |ŸYêùüþÿÿÿýÿÿÿÿoÿ|
0007424b fd ff ff ff ff ff ff e1 ff 3a 6f ff 1f f7 9f 16 |ýÿÿÿÿÿÿáÿ:oÿ.÷..|

0007825b be 59 ea f9 fc fe ff ff ff fd ef ff ff ff 6f ff |ŸYêùüþÿÿÿýïÿÿÿoÿ|
0007826b fd ff ff ff ff ff ff e1 ff 3a 6f ff 1f f7 9f 56 |ýÿÿÿÿÿÿáÿ:oÿ.÷.V|

0007c27b be 59 ea f9 fc fe ff ff ff fd df ff ff ff 6f ff |ŸYêùüþÿÿÿýßÿÿÿoÿ|
0007c28b fd ff ff ff ff ff ff e1 ff 3a 6f ff 1f f7 9f 96 |ýÿÿÿÿÿÿáÿ:oÿ.÷..|

0008029b be d9 ea f9 fc fe 1b 59 ff fd cf ff ff ff 6f ff |ŸÙêùüþ.YÿýÏÿÿÿoÿ|
000802ab fd ff ff ff ff ff ff e1 ff 3b 6f ff 1f f7 c8 cf |ýÿÿÿÿÿÿáÿ;oÿ.÷ÈÏ|

00083c30 be d9 ea f9 fc fe ff ff ff ff ff ff ff ff 6f ff |ŸÙêùüþÿÿÿÿÿÿÿÿoÿ|
00083c40 fd ff f7 ff ff ff ff ff ff 3a 6f ff 1e f7 92 16 |ýÿ÷ÿÿÿÿÿÿ:oÿ.÷..|

00087c50 be 59 ea f9 fc fe ff ff ff ff ef ff ff ff 6f ff |ŸYêùüþÿÿÿÿïÿÿÿoÿ|
00087c60 fd ff ff ff ff ff ff e1 ff 3a 6f ff 1e f7 a1 56 |ýÿÿÿÿÿÿáÿ:oÿ.÷¡V|

0008bc70 be 59 ea f9 fc fe ff ff ff ff df ff ff ff 6f ff |ŸYêùüþÿÿÿÿßÿÿÿoÿ|
0008bc80 fd ff ff ff ff ff ff e1 ff 3a 6f ff 1e f7 a1 96 |ýÿÿÿÿÿÿáÿ:oÿ.÷¡.|

0008fc90 be 59 ea f9 fc fe b3 df ff ff cf ff ff ff 6f ff |ŸYêùüþ³ßÿÿÏÿÿÿoÿ|
0008fca0 fd ff ff ff ff ff ff e1 ff 3b 6f ff 1e f7 a9 a9 |ýÿÿÿÿÿÿáÿ;oÿ.÷©©|

Aluratek AIREC01F #6

The excellent signsrch tool confirms what I've found in episode 4:

$ signsrch ShrekW.BIN

...

offset num description [bits.endian.size]
--------------------------------------------
0008bc90 190 Blowfish bfp table [32.le.72]
0008bcd8 192 Blowfish ks0 table [32.le.1024]
0008c0d8 194 Blowfish ks1 table [32.le.1024]
0008c4d8 196 Blowfish ks2 table [32.le.1024]
0008c8d8 198 Blowfish ks3 table [32.le.1024]
00019c0d 309 padding used in hashing algorithms (0x80 0 ... 0) [..64]
0008bcb0 325 Haval hash pass2 [32.le.128&]
0008bc90 1299 Haval init [32.le.32&]
0008bd30 1301 Haval mc3 [32.le.128]
0008bdb0 1303 Haval mc4 [32.le.128]
0008be30 1305 Haval mc5 [32.le.128]
0008be10 1451 HAVAL1_DS [32.le.32]
0008bd90 1453 HAVAL2_DS [32.le.32]
0008bcd8 1561 Blowfish_s_init [32.le.4096]

- 14 signatures found in the file

Tuesday, February 22, 2011

Aluratek AIREC01F #5

$ java ByteEntropy -c -r 512 -w 200 -o ShrekW.BIN.ent -f ShrekW.BIN

Monday, February 21, 2011

Aluratek AIREC01F #4

http://www.opensource.apple.com/source/xnu/xnu-1456.1.26/bsd/crypto/blowfish/bf_pi.h

static const BF_KEY bf_init= {
{
0x243f6a88L, 0x85a308d3L, 0x13198a2eL, 0x03707344L,
0xa4093822L, 0x299f31d0L, 0x082efa98L, 0xec4e6c89L,
0x452821e6L, 0x38d01377L, 0xbe5466cfL, 0x34e90c6cL,
0xc0ac29b7L, 0xc97c50ddL, 0x3f84d5b5L, 0xb5470917L,
0x9216d5d9L, 0x8979fb1b
},{
0xd1310ba6L, 0x98dfb5acL, 0x2ffd72dbL, 0xd01adfb7L,
0xb8e1afedL, 0x6a267e96L, 0xba7c9045L, 0xf12c7f99L,
0x24a19947L, 0xb3916cf7L, 0x0801f2e2L, 0x858efc16L,
...
0x90d4f869L, 0xa65cdea0L, 0x3f09252dL, 0xc208e69fL,
0xb74e6132L, 0xce77e25bL, 0x578fdfe3L, 0x3ac372e6L,
}
};

The cipher used is Blowfish. In this header file, the first array corresponds to the P-array, and the second to the S-box.

$ hd ShrekW.BIN | grep "88 6a 3f 24"
0008bc90 88 6a 3f 24 d3 08 a3 85 2e 8a 19 13 44 73 70 03 |.j?$Ó.£.....Dsp.|

We can see the P-array starting at 0x0008bc90.

$ hd ShrekW.BIN | grep "a6 0b 31 d1"
0008bcd0 d9 d5 16 92 1b fb 79 89 a6 0b 31 d1 ac b5 df 98 |ÙÕ...ûy.Š.1Ѭµß.|

$ hd ShrekW.BIN | grep "e6 72 c3 3a"
0008ccd0 e3 df 8f 57 e6 72 c3 3a ff ff ff ff ff ff ff ff |ãß.WærÃ:ÿÿÿÿÿÿÿÿ|

The S-box starts at 0x0008bcd8 and ends at 0x0008ccd8.

Wednesday, February 16, 2011

Aluratek AIREC01F #3

$ ent -c -t ShrekW.BIN | awk -F',' '/^3/ {printf "%d, 0x%02X, %f\n", $3,$2,$4}' | sort -g -r
103911, 0xFF, 0.174967
74057, 0x00, 0.124698
7849, 0x20, 0.013216
5920, 0x01, 0.009968
5175, 0x06, 0.008714
4953, 0x03, 0.008340
4724, 0x46, 0.007954
4590, 0x10, 0.007729
4526, 0x74, 0.007621
4389, 0x09, 0.007390
4322, 0x02, 0.007277
4037, 0x80, 0.006798
4033, 0xF0, 0.006791
4002, 0x8B, 0.006739
3647, 0xC0, 0.006141
3643, 0x61, 0.006134
3621, 0x04, 0.006097
3611, 0x08, 0.006080
3494, 0x75, 0.005883
3476, 0x65, 0.005853
3429, 0xE0, 0.005774
3168, 0x50, 0.005334
3098, 0xFE, 0.005216
3041, 0x72, 0.005120
3024, 0x0A, 0.005092
3009, 0x83, 0.005067
3009, 0x30, 0.005067
2967, 0x40, 0.004996
2895, 0xEB, 0.004875
2887, 0x05, 0.004861
2771, 0x90, 0.004666
2706, 0x56, 0.004556
2703, 0xE9, 0.004551
2642, 0x11, 0.004449
2641, 0x3E, 0.004447
2591, 0x70, 0.004363
2590, 0x7F, 0.004361
2559, 0x07, 0.004309
2519, 0xD0, 0.004242
2443, 0xB0, 0.004114
2439, 0x60, 0.004107
2420, 0x6A, 0.004075
2396, 0x89, 0.004034
2391, 0x26, 0.004026
2367, 0x6E, 0.003986
2344, 0x12, 0.003947
2320, 0x6F, 0.003906
2204, 0x0B, 0.003711
2170, 0x0E, 0.003654
2160, 0x68, 0.003637
2146, 0x3C, 0.003613
2118, 0x33, 0.003566
2110, 0xA0, 0.003553
2092, 0xF8, 0.003523
2068, 0x76, 0.003482
2065, 0xBF, 0.003477
2052, 0x69, 0.003455
2027, 0xEF, 0.003413
2025, 0x73, 0.003410
1999, 0x0C, 0.003366
1993, 0x1E, 0.003356
1982, 0xFC, 0.003337
1977, 0x2F, 0.003329
1948, 0x0D, 0.003280
1932, 0x21, 0.003253
1929, 0x24, 0.003248
1926, 0xF6, 0.003243
1917, 0x0F, 0.003228
1910, 0x64, 0.003216
1897, 0xF7, 0.003194
1897, 0xDF, 0.003194
1888, 0x9A, 0.003179
1855, 0x81, 0.003123
1846, 0x1F, 0.003108
1841, 0x41, 0.003100
1814, 0xC1, 0.003054
1814, 0x47, 0.003054
1805, 0x7E, 0.003039
1802, 0x22, 0.003034
1801, 0xC7, 0.003033
1801, 0x6C, 0.003033
1765, 0xD2, 0.002972
1744, 0x31, 0.002937
1743, 0xFA, 0.002935
1721, 0xF1, 0.002898
1717, 0x52, 0.002891
1701, 0xC6, 0.002864
1700, 0x5E, 0.002862
1696, 0xC2, 0.002856
1687, 0xA1, 0.002841
1684, 0x53, 0.002836
1683, 0xF2, 0.002834
1653, 0x3F, 0.002783
1630, 0x8A, 0.002745
1628, 0xFD, 0.002741
1625, 0xF4, 0.002736
1611, 0x16, 0.002713
1597, 0x5F, 0.002689
1573, 0xE8, 0.002649
1561, 0x63, 0.002628
1557, 0xF5, 0.002622
1554, 0x3B, 0.002617
1530, 0xC4, 0.002576
1527, 0x18, 0.002571
1525, 0x44, 0.002568
1520, 0x54, 0.002559
1513, 0x14, 0.002548
1511, 0x13, 0.002544
1504, 0x23, 0.002532
1500, 0xD1, 0.002526
1497, 0xE1, 0.002521
1493, 0xFB, 0.002514
1488, 0xE2, 0.002506
1455, 0x62, 0.002450
1433, 0x71, 0.002413
1431, 0x51, 0.002410
1422, 0xE4, 0.002394
1418, 0x32, 0.002388
1406, 0xCF, 0.002367
1406, 0x6D, 0.002367
1400, 0x82, 0.002357
1395, 0xB1, 0.002349
1395, 0x4F, 0.002349
1384, 0x87, 0.002330
1368, 0xA3, 0.002303
1367, 0x43, 0.002302
1365, 0xE6, 0.002298
1363, 0x77, 0.002295
1350, 0x91, 0.002273
1347, 0xEE, 0.002268
1331, 0x88, 0.002241
1329, 0xF3, 0.002238
1290, 0x9F, 0.002172
1290, 0x66, 0.002172
1278, 0xAF, 0.002152
1272, 0x57, 0.002142
1249, 0x7C, 0.002103
1241, 0x36, 0.002090
1234, 0xD3, 0.002078
1231, 0x42, 0.002073
1221, 0xC3, 0.002056
1216, 0xC8, 0.002048
1208, 0xDE, 0.002034
1197, 0xD7, 0.002016
1195, 0x4E, 0.002012
1189, 0x45, 0.002002
1185, 0x1C, 0.001995
1184, 0xE5, 0.001994
1178, 0x28, 0.001984
1177, 0x55, 0.001982
1171, 0xD8, 0.001972
1169, 0x25, 0.001968
1166, 0x8F, 0.001963
1165, 0x34, 0.001962
1164, 0xB4, 0.001960
1155, 0xB8, 0.001945
1155, 0x2E, 0.001945
1153, 0xDA, 0.001941
1150, 0x67, 0.001936
1139, 0xE3, 0.001918
1094, 0xD6, 0.001842
1089, 0x3D, 0.001834
1086, 0x38, 0.001829
1083, 0xEC, 0.001824
1081, 0xEA, 0.001820
1079, 0xA2, 0.001817
1066, 0x2B, 0.001795
1065, 0xF9, 0.001793
1062, 0x49, 0.001788
1056, 0x7D, 0.001778
1055, 0xB2, 0.001776
1052, 0x48, 0.001771
1051, 0xD9, 0.001770
1049, 0x15, 0.001766
1040, 0x59, 0.001751
1039, 0x3A, 0.001749
1035, 0xDB, 0.001743
1034, 0x84, 0.001741
1031, 0x92, 0.001736
1005, 0xBE, 0.001692
1004, 0xDC, 0.001691
992, 0xD4, 0.001670
981, 0x4C, 0.001652
976, 0x2C, 0.001643
968, 0xCB, 0.001630
968, 0xB3, 0.001630
967, 0x35, 0.001628
966, 0x94, 0.001627
964, 0x1A, 0.001623
963, 0x17, 0.001622
962, 0x1B, 0.001620
960, 0x93, 0.001616
953, 0x97, 0.001605
941, 0x2A, 0.001584
933, 0x79, 0.001571
926, 0xB7, 0.001559
925, 0x78, 0.001558
924, 0x2D, 0.001556
919, 0xC9, 0.001547
917, 0x8C, 0.001544
913, 0xBA, 0.001537
913, 0x98, 0.001537
909, 0xB6, 0.001531
906, 0x19, 0.001526
905, 0xCC, 0.001524
902, 0x1D, 0.001519
900, 0xD5, 0.001515
883, 0xCE, 0.001487
880, 0x4D, 0.001482
871, 0xBB, 0.001467
869, 0x29, 0.001463
865, 0x85, 0.001456
865, 0x5C, 0.001456
864, 0xA4, 0.001455
859, 0xE7, 0.001446
854, 0xB5, 0.001438
851, 0x99, 0.001433
851, 0x8E, 0.001433
843, 0x86, 0.001419
838, 0xAA, 0.001411
821, 0x6B, 0.001382
811, 0xCA, 0.001366
809, 0x96, 0.001362
805, 0xED, 0.001355
804, 0x8D, 0.001354
797, 0x7A, 0.001342
795, 0xAE, 0.001339
792, 0x39, 0.001334
787, 0xDD, 0.001325
784, 0xA5, 0.001320
782, 0x4A, 0.001317
777, 0x27, 0.001308
775, 0x37, 0.001305
769, 0x58, 0.001295
762, 0xA9, 0.001283
753, 0xBC, 0.001268
751, 0x7B, 0.001265
751, 0x5A, 0.001265
745, 0x9E, 0.001254
741, 0x5B, 0.001248
734, 0x95, 0.001236
724, 0xC5, 0.001219
716, 0xAB, 0.001206
706, 0xA6, 0.001189
702, 0xB9, 0.001182
699, 0x9C, 0.001177
699, 0x5D, 0.001177
689, 0xCD, 0.001160
687, 0x4B, 0.001157
686, 0xA8, 0.001155
672, 0x9D, 0.001132
663, 0xBD, 0.001116
654, 0xA7, 0.001101
648, 0xAC, 0.001091
607, 0xAD, 0.001022
606, 0x9B, 0.001020

Aluratek AIREC01F #2

$ ent -c ShrekW.BIN
Value Char Occurrences Fraction
0 74057 0.124698
1 5920 0.009968
2 4322 0.007277
3 4953 0.008340
4 3621 0.006097
5 2887 0.004861
6 5175 0.008714
7 2559 0.004309
8 3611 0.006080
9 4389 0.007390
10 3024 0.005092
11 2204 0.003711
12 1999 0.003366
13 1948 0.003280
14 2170 0.003654
15 1917 0.003228
16 4590 0.007729
17 2642 0.004449
18 2344 0.003947
19 1511 0.002544
20 1513 0.002548
21 1049 0.001766
22 1611 0.002713
23 963 0.001622
24 1527 0.002571
25 906 0.001526
26 964 0.001623
27 962 0.001620
28 1185 0.001995
29 902 0.001519
30 1993 0.003356
31 1846 0.003108
32 7849 0.013216
33 ! 1932 0.003253
34 " 1802 0.003034
35 # 1504 0.002532
36 $ 1929 0.003248
37 % 1169 0.001968
38 & 2391 0.004026
39 ' 777 0.001308
40 ( 1178 0.001984
41 ) 869 0.001463
42 * 941 0.001584
43 + 1066 0.001795
44 , 976 0.001643
45 - 924 0.001556
46 . 1155 0.001945
47 / 1977 0.003329
48 0 3009 0.005067
49 1 1744 0.002937
50 2 1418 0.002388
51 3 2118 0.003566
52 4 1165 0.001962
53 5 967 0.001628
54 6 1241 0.002090
55 7 775 0.001305
56 8 1086 0.001829
57 9 792 0.001334
58 : 1039 0.001749
59 ; 1554 0.002617
60 < 2146 0.003613
61 = 1089 0.001834
62 > 2641 0.004447
63 ? 1653 0.002783
64 @ 2967 0.004996
65 A 1841 0.003100
66 B 1231 0.002073
67 C 1367 0.002302
68 D 1525 0.002568
69 E 1189 0.002002
70 F 4724 0.007954
71 G 1814 0.003054
72 H 1052 0.001771
73 I 1062 0.001788
74 J 782 0.001317
75 K 687 0.001157
76 L 981 0.001652
77 M 880 0.001482
78 N 1195 0.002012
79 O 1395 0.002349
80 P 3168 0.005334
81 Q 1431 0.002410
82 R 1717 0.002891
83 S 1684 0.002836
84 T 1520 0.002559
85 U 1177 0.001982
86 V 2706 0.004556
87 W 1272 0.002142
88 X 769 0.001295
89 Y 1040 0.001751
90 Z 751 0.001265
91 [ 741 0.001248
92 \ 865 0.001456
93 ] 699 0.001177
94 ^ 1700 0.002862
95 _ 1597 0.002689
96 ` 2439 0.004107
97 a 3643 0.006134
98 b 1455 0.002450
99 c 1561 0.002628
100 d 1910 0.003216
101 e 3476 0.005853
102 f 1290 0.002172
103 g 1150 0.001936
104 h 2160 0.003637
105 i 2052 0.003455
106 j 2420 0.004075
107 k 821 0.001382
108 l 1801 0.003033
109 m 1406 0.002367
110 n 2367 0.003986
111 o 2320 0.003906
112 p 2591 0.004363
113 q 1433 0.002413
114 r 3041 0.005120
115 s 2025 0.003410
116 t 4526 0.007621
117 u 3494 0.005883
118 v 2068 0.003482
119 w 1363 0.002295
120 x 925 0.001558
121 y 933 0.001571
122 z 797 0.001342
123 { 751 0.001265
124 | 1249 0.002103
125 } 1056 0.001778
126 ~ 1805 0.003039
127 2590 0.004361
128 4037 0.006798
129 1855 0.003123
130 1400 0.002357
131 3009 0.005067
132 1034 0.001741
133 865 0.001456
134 843 0.001419
135 1384 0.002330
136 1331 0.002241
137 2396 0.004034
138 1630 0.002745
139 4002 0.006739
140 917 0.001544
141 804 0.001354
142 851 0.001433
143 1166 0.001963
144 2771 0.004666
145 1350 0.002273
146 1031 0.001736
147 960 0.001616
148 966 0.001627
149 734 0.001236
150 809 0.001362
151 953 0.001605
152 913 0.001537
153 851 0.001433
154 1888 0.003179
155 606 0.001020
156 699 0.001177
157 672 0.001132
158 745 0.001254
159 1290 0.002172
160 2110 0.003553
161 ¡ 1687 0.002841
162 ¢ 1079 0.001817
163 £ 1368 0.002303
164 € 864 0.001455
165 ¥ 784 0.001320
166 Š 706 0.001189
167 § 654 0.001101
168 š 686 0.001155
169 © 762 0.001283
170 ª 838 0.001411
171 « 716 0.001206
172 ¬ 648 0.001091
173 ­ 607 0.001022
174 ® 795 0.001339
175 ¯ 1278 0.002152
176 ° 2443 0.004114
177 ± 1395 0.002349
178 ² 1055 0.001776
179 ³ 968 0.001630
180 Ž 1164 0.001960
181 µ 854 0.001438
182 ¶ 909 0.001531
183 · 926 0.001559
184 ž 1155 0.001945
185 ¹ 702 0.001182
186 º 913 0.001537
187 » 871 0.001467
188 Œ 753 0.001268
189 œ 663 0.001116
190 Ÿ 1005 0.001692
191 ¿ 2065 0.003477
192 À 3647 0.006141
193 Á 1814 0.003054
194 Â 1696 0.002856
195 Ã 1221 0.002056
196 Ä 1530 0.002576
197 Å 724 0.001219
198 Æ 1701 0.002864
199 Ç 1801 0.003033
200 È 1216 0.002048
201 É 919 0.001547
202 Ê 811 0.001366
203 Ë 968 0.001630
204 Ì 905 0.001524
205 Í 689 0.001160
206 Î 883 0.001487
207 Ï 1406 0.002367
208 Ð 2519 0.004242
209 Ñ 1500 0.002526
210 Ò 1765 0.002972
211 Ó 1234 0.002078
212 Ô 992 0.001670
213 Õ 900 0.001515
214 Ö 1094 0.001842
215 × 1197 0.002016
216 Ø 1171 0.001972
217 Ù 1051 0.001770
218 Ú 1153 0.001941
219 Û 1035 0.001743
220 Ü 1004 0.001691
221 Ý 787 0.001325
222 Þ 1208 0.002034
223 ß 1897 0.003194
224 à 3429 0.005774
225 á 1497 0.002521
226 â 1488 0.002506
227 ã 1139 0.001918
228 ä 1422 0.002394
229 å 1184 0.001994
230 æ 1365 0.002298
231 ç 859 0.001446
232 è 1573 0.002649
233 é 2703 0.004551
234 ê 1081 0.001820
235 ë 2895 0.004875
236 ì 1083 0.001824
237 í 805 0.001355
238 î 1347 0.002268
239 ï 2027 0.003413
240 ð 4033 0.006791
241 ñ 1721 0.002898
242 ò 1683 0.002834
243 ó 1329 0.002238
244 ô 1625 0.002736
245 õ 1557 0.002622
246 ö 1926 0.003243
247 ÷ 1897 0.003194
248 ø 2092 0.003523
249 ù 1065 0.001793
250 ú 1743 0.002935
251 û 1493 0.002514
252 ü 1982 0.003337
253 ý 1628 0.002741
254 þ 3098 0.005216
255 ÿ 103911 0.174967

Total: 593890 1.000000

Entropy = 6.612363 bits per byte.

Optimum compression would reduce the size
of this 593890 byte file by 17 percent.

Chi square distribution for 593890 samples is 6831666.89, and randomly
would exceed this value 0.01 percent of the times.

Arithmetic mean value of data bytes is 125.4687 (127.5 = random).
Monte Carlo value for Pi is 2.759883210 (error 12.15 percent).
Serial correlation coefficient is 0.503309 (totally uncorrelated = 0.0).

Aluratek AIREC01F #1


$ unzip -d 1.49 AIREC01F_v1.49.zip
Archive: AIREC01F_v1.49.zip
inflating: 1.49/ShrekW.BIN

$ cd 1.49/

$ du -b ShrekW.BIN
593890 ShrekW.BIN

$ file ShrekW.BIN
ShrekW.BIN: data

$ hd -n 256 ShrekW.BIN
00000000 be d9 ea 39 fc fe ff ff ff ff ff ff ff ff 6f ff |ŸÙê9üþÿÿÿÿÿÿÿÿoÿ|
00000010 fd ff f7 ff ff ff ff ff ff 3a 6f ff 1f f7 91 16 |ýÿ÷ÿÿÿÿÿÿ:oÿ.÷..|
00000020 08 05 00 00 00 00 00 00 00 00 00 00 09 00 00 00 |................|
00000030 60 00 00 00 30 0d 00 00 f0 19 00 00 80 26 00 00 |`...0...ð....&..|
00000040 d0 32 00 00 00 40 00 00 d0 4c 00 00 50 59 00 00 |Ð2...@..ÐL..PY..|
00000050 70 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |pe..............|
00000060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000080 4a 5a ff 80 00 00 00 00 b1 0c 00 00 00 00 00 00 |JZÿ.....±.......|
00000090 ff 10 01 5a 00 2b 00 10 01 ff 2e 01 40 01 5a 01 |ÿ..Z.+...ÿ..@.Z.|
000000a0 70 01 ff 7c 01 88 01 92 01 a6 01 ff ba 01 cc 01 |p.ÿ|.....Š.ÿº.Ì.|
000000b0 de 01 00 02 ff 12 02 32 02 4e 02 6a 02 ff 88 02 |Þ...ÿ..2.N.j.ÿ..|
000000c0 b0 02 de 02 04 03 ff 1a 03 30 03 44 03 5c 03 ff |°.Þ...ÿ..0.D.\.ÿ|
000000d0 7a 03 92 03 aa 03 c4 03 ff e2 03 08 04 3a 04 6a |z...ª.Ä.ÿâ...:.j|
000000e0 04 ff 86 04 a8 04 c4 04 e0 04 ff fc 04 1c 05 3e |.ÿ..š.Ä.à.ÿü...>|
000000f0 05 6e 05 ff 92 05 b4 05 de 05 1e 06 ff 5a 06 88 |.n.ÿ..Ž.Þ...ÿZ..|
00000100