Finally reproduced the buggy hash with string "abc". Some example:
#include <stdint.h>
#include <stdio.h>
#include <string.h>
typedef struct
{
uint32_t state[5];
uint32_t count[2];
unsigned char buffer[64];
} SHA1_CTX;
#define rol(value,bits) (((value)<<(bits))|((value)>>(32-(bits))))
#define blk0(i) is_bigendian?block->l[i]:(block->l[i]=(rol(block->l[i],24)&0xff00ff00)|(rol(block->l[i],8)&0x00ff00ff))
#define blk(i) (block->l[i&15]=rol(block->l[(i+13)&15]^block->l[(i+8)&15]^block->l[(i+2)&15]^block->l[i&15],1))
#define R0(v,w,x,y,z,i) z+=((w&(x^y))^y)+blk0(i)+0x5a827999+rol(v,5);w=rol(w,30);
#define R1(v,w,x,y,z,i) z+=((w&(x^y))^y)+blk(i)+0x5a827999+rol(v,5);w=rol(w,30);
#define R2(v,w,x,y,z,i) z+=(w^x^y)+blk(i)+0x6ed9eba1+rol(v,5);w=rol(w,30);
#define R3(v,w,x,y,z,i) z+=(((w|x)&y)|(w&x))+blk(i)+0x8f1bbcdc+rol(v,5);w=rol(w,30);
#define R4(v,w,x,y,z,i) z+=(w^x^y)+blk(i)+0xca62c1d6+rol(v,5);w=rol(w,30);
void __db_SHA1Transform(uint32_t* state,unsigned char* buffer)
{
int is_bigendian=0; //use zero or one
typedef union
{
unsigned char c[64];
uint32_t l[16];
} CHAR64LONG16;
unsigned char workspace[64];
CHAR64LONG16* block=(CHAR64LONG16*)workspace;
memcpy(block,buffer,64);
uint32_t a=state[0];
uint32_t b=state[1];
uint32_t c=state[2];
uint32_t d=state[3];
uint32_t e=state[4];
R0(a,b,c,d,e, 0); R0(e,a,b,c,d, 1); R0(d,e,a,b,c, 2); R0(c,d,e,a,b, 3);
R0(b,c,d,e,a, 4); R0(a,b,c,d,e, 5); R0(e,a,b,c,d, 6); R0(d,e,a,b,c, 7);
R0(c,d,e,a,b, 8); R0(b,c,d,e,a, 9); R0(a,b,c,d,e,10); R0(e,a,b,c,d,11);
R0(d,e,a,b,c,12); R0(c,d,e,a,b,13); R0(b,c,d,e,a,14); R0(a,b,c,d,e,15);
R1(e,a,b,c,d,16); R1(d,e,a,b,c,17); R1(c,d,e,a,b,18); R1(b,c,d,e,a,19);
R2(a,b,c,d,e,20); R2(e,a,b,c,d,21); R2(d,e,a,b,c,22); R2(c,d,e,a,b,23);
R2(b,c,d,e,a,24); R2(a,b,c,d,e,25); R2(e,a,b,c,d,26); R2(d,e,a,b,c,27);
R2(c,d,e,a,b,28); R2(b,c,d,e,a,29); R2(a,b,c,d,e,30); R2(e,a,b,c,d,31);
R2(d,e,a,b,c,32); R2(c,d,e,a,b,33); R2(b,c,d,e,a,34); R2(a,b,c,d,e,35);
R2(e,a,b,c,d,36); R2(d,e,a,b,c,37); R2(c,d,e,a,b,38); R2(b,c,d,e,a,39);
R3(a,b,c,d,e,40); R3(e,a,b,c,d,41); R3(d,e,a,b,c,42); R3(c,d,e,a,b,43);
R3(b,c,d,e,a,44); R3(a,b,c,d,e,45); R3(e,a,b,c,d,46); R3(d,e,a,b,c,47);
R3(c,d,e,a,b,48); R3(b,c,d,e,a,49); R3(a,b,c,d,e,50); R3(e,a,b,c,d,51);
R3(d,e,a,b,c,52); R3(c,d,e,a,b,53); R3(b,c,d,e,a,54); R3(a,b,c,d,e,55);
R3(e,a,b,c,d,56); R3(d,e,a,b,c,57); R3(c,d,e,a,b,58); R3(b,c,d,e,a,59);
R4(a,b,c,d,e,60); R4(e,a,b,c,d,61); R4(d,e,a,b,c,62); R4(c,d,e,a,b,63);
R4(b,c,d,e,a,64); R4(a,b,c,d,e,65); R4(e,a,b,c,d,66); R4(d,e,a,b,c,67);
R4(c,d,e,a,b,68); R4(b,c,d,e,a,69); R4(a,b,c,d,e,70); R4(e,a,b,c,d,71);
R4(d,e,a,b,c,72); R4(c,d,e,a,b,73); R4(b,c,d,e,a,74); R4(a,b,c,d,e,75);
R4(e,a,b,c,d,76); R4(d,e,a,b,c,77); R4(c,d,e,a,b,78); R4(b,c,d,e,a,79);
state[0]+=a;
state[1]+=b;
state[2]+=c;
state[3]+=d;
state[4]+=e;
a=b=c=d=e=0;
}
void __db_SHA1Init(SHA1_CTX* context)
{
context->state[0]=0x67452301;
context->state[1]=0xefcdab89;
context->state[2]=0x98badcfe;
context->state[3]=0x10325476;
context->state[4]=0xc3d2e1f0;
context->count[0]=context->count[1]=0;
}
void __db_SHA1Update(SHA1_CTX* context,unsigned char* data,size_t len)
{
uint32_t i;
uint32_t j=(context->count[0]>>3)&63;
if((context->count[0]+=(uint32_t)len<<3)<(len<<3))
{
++context->count[1];
}
context->count[1]+=(uint32_t)(len>>29);
if((j+len)>63)
{
memcpy(&context->buffer[j],data,(i=64-j));
__db_SHA1Transform(context->state,context->buffer);
for(;i+63<len;i+=64)
{
__db_SHA1Transform(context->state,&data[i]);
}
j=0;
}
else i=0;
memcpy(&context->buffer[j],&data[i],len-i);
}
void __db_SHA1Final(unsigned char* digest,SHA1_CTX* context)
{
uint32_t i;
unsigned char finalcount[8];
for(i=0;i<8;++i)
{
finalcount[i]=(unsigned char)((context->count[(i>=4?0:1)]>>((3-(i&3))*8))&255);
}
__db_SHA1Update(context,(unsigned char*)"\200",1);
while((context->count[0]&504)!=448)
{
__db_SHA1Update(context,(unsigned char *)"\0",1);
}
__db_SHA1Update(context,finalcount,8);
for(i=0;i<20;++i)
{
digest[i]=(unsigned char)((context->state[i>>2]>>((3-(i&3))*8))&255);
}
i=0;
memset(context->buffer,0,64);
memset(context->state,0,20);
memset(context->count,0,8);
memset(finalcount,0,8);
__db_SHA1Transform(context->state,context->buffer);
}
int main(void)
{
SHA1_CTX sha;
uint8_t results[20];
char* buf="abc";
int n=strlen(buf);
__db_SHA1Init(&sha);
__db_SHA1Update(&sha,(uint8_t*)buf,n);
__db_SHA1Final(results,&sha);
printf("0x");
for(n=0;n<20;++n)
{
printf("%02x",results[n]);
}
putchar('\n');
return 0;
}
I will try to analyze it later, round-by-round, to see, what exactly is going on. But it is a good start, to have some "standalone" code, without additional dependencies, which can produce the same results.
