I am attempting to demonstrate a simple proof of concept with respect to a vulnerability in a piece of code in a game written in C.
Let's say that we want to validate a character login. The login is handled by the user choosing n items, (let's just assume n=5 for now) from a graphical menu. The items are all medieval themed:
eg:
_______________________________
| | | |
| Bow | Sword | Staff |
|-----------|-----------|-------|
| Shield | Potion | Gold |
|___________|___________|_______|
The user must click on each item, then choose a number for each item.
The validation algorithm then does the following:
Determines which items were selected
Drops each string to lowercase (ie: Bow becomes bow, etc)
Calculates a simple string hash for each string (ie: `bow = b=2, o=15, w=23, sum = (2+15+23=40)
Multiplies the hash by the value the user selected for the corresponding item; This new value is called the key
Sums together the keys for each of the selected items; this is the final validation hash
IMPORTANT: The validator will accept this hash, along with non-zero multiples of it (ie: if the final hash equals 1111, then 2222, 3333, 8888, etc are also valid).
So, for example, let's say I select:
Bow (1)
Sword (2)
Staff (10)
Shield (1)
Potion (6)
The algorithm drops each of these strings to lowercase, calculates their string hashes, multiplies that hash by the number selected for each string, then sums these keys together.
eg:
Final_Validation_Hash = 1*HASH(Bow) + 2*HASH(Sword) + 10*HASH(Staff) + 1*HASH(Shield) + 6*HASH(Potion)
By application of Euler's Method, I plan to demonstrate that these hashes are not unique, and want to devise a simple application to prove it.
in my case, for 5 items, I would essentially be trying to calculate:
(B)(y) = (A_1)(x_1) + (A_2)(x_2) + (A_3)(x_3) + (A_4)(x_4) + (A_5)(x_5)
Where:
B is arbitrary
A_j are the selected coefficients/values for each string/category
x_j are the hash values for each string/category
y is the final validation hash (eg: 1111 above)
B,y,A_j,x_j are all discrete-valued, positive, and non-zero (ie: natural numbers)
Can someone either assist me in solving this problem or point me to a similar example (ie: code, worked out equations, etc)? I just need to solve the final step (ie: (B)(Y) = ...).
Thank you all in advance.
