vim-blowfish-decrypt.c

#include <stdio.h>
#include <string.h>
#include <openssl/blowfish.h>
#include <openssl/sha.h>

void keygen(unsigned char *pass, unsigned char *salt, unsigned char *key) {
	unsigned char buf[72];
	memcpy(buf, pass, 16);
	memcpy(buf+16, salt, 8);
	int l = 24;
	SHA256_CTX c;
	for (int i = 0; i < 1001; i++) {
		SHA256_Init(&c);
		SHA256_Update(&c, buf, l);
		SHA256_Final(key, &c);
		for (int j = 0; j < 32; j++) {
			sprintf((char*)buf+2*j, "%02x", key[j]);
		}
		memcpy(buf+64, salt, 8);
		l = 72;
	}
}

void decrypt(unsigned char *key, BF_LONG *iv, BF_LONG *chunk, BF_LONG *plain) {
	BF_KEY bf_key;
	BF_set_key(&bf_key, 32, key);
	BF_encrypt(iv, &bf_key);
	plain[0] = iv[0] ^ chunk[0];
	plain[1] = iv[1] ^ chunk[1];
}

int main(int argc, char *argv[]) {
	FILE *fp = fopen(argv[1], "r");
	unsigned char salt[8];
	BF_LONG iv[2], chunk[2], plain[2];
	fseek(fp, 12, SEEK_CUR); /* skip magic */
	fread(salt, 1, 8, fp); /* read salt */
	fread(iv, 4, 2, fp); /* read iv */
	fread(chunk, 4, 2, fp); /* read the first chunk */

	unsigned char pass[16];
	for (int i = 0; i < 16; i++) {
		pass[i] = 'a';
	}
	unsigned char key[32];
	keygen(pass, salt, key);

	decrypt(key, iv, chunk, plain);
	fwrite(plain, 4, 2, stdout);
	return 0;
}