On Fri, 2006-11-17 at 07:24 -0700, Matthew Wilcox wrote: > I *think* the xor mask is mere obfuscation. It looks likely that you can > recover it with a little bit of trial and error. If you can force the > filesystem to hand you back new inodes quickly such that there is a high > probability you get consecutive allocations, you'll get a sequence which > would be spaced 700-odd bytes apart, except that it's been xored. Since > you know it's incrementing, if you see the sequence decrease, you'll > know that was a 1 in that bit.
I think you're right, the addresses would often be sequential, so this is probably crackable. I'll look over the md5 routines when I get the chance, though if someone more cryptographically inclined than I has a different suggestion, I'd love to hear it. -- Jeff - To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
