From: Anonymous <nobody@replay.com>
Date: Fri, 3 Jul 1998 00:35:17 -0700 (PDT)
To: cypherpunks@toad.com
Subject: Beginning of process of decrypting net-nanny files (fwd)
Message-ID: <199807030736.JAA07229@basement.replay.com>
MIME-Version: 1.0
Content-Type: text/plain


Article 425292 of alt.religion.scientology:
Newsgroups: alt.religion.scientology
Subject: Beginning of process of decrypting net-nanny files
Date: Thu, 02 Jul 1998 00:28:03 -0700
Lines: 100
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit



There are three files with the netnanny, called d32l.dll,
n32l.dll, and p32l.dll.                                    
These are not really dlls, but are almost certainly the
database of words and phrases that the netnanny is interested
in.

If you look at these files, there is a total of 1037 lines,
each of which has from 10 or so to 60 or so characters.
It turns out (see below) that two characters in the data file
almost certainly map to 1 character of the plaintext, so
the phrases are 5 to 30 characters long.  1037 phrases of
5 to 30 characters seems about right.

If you look closely at the text, you'll see that they letters
alternate between the ranges of 32-63 and 96-127 (decimal).
That is, a line begins "1{7}.f#f".  The 1, 7, ., and #
are all in the range 32-63, and the {, }, f, and f are in the
range 96-127.  Each of these letters, then, can take one of
32 values, or five bits.  If you combine these, you find that
there are only 512 combinations used of the pairs of letters,
instead of the expected 1024 (=2^10).  It turns out that if
you construct a 10 bit word with the first 5 bits from the
first character and the second 5 from the second character,
then you find that the middle two bits are always either both 
0 or both 1.  So, there are 512 possibilities.

These 512 numbers are fairly uniformly distributed, so this is
not a simple substitution cipher.  Interestingly, though, again,
using the above construction of a 10 bit number from the two five
bit pairs, you find that the high order bits change very slowly
if at all from character to character. This is the beginning of
d32l.dll (fair use quotation of two lines from the file)

1101110001
1100110100
1100110011
0011001110
0011110000
0001110101
0010000000
0010000001
0010001111
0011001010
0001000100
0001001101
0000001110 
0010000101
0000001000
0111110101
0110110111

0110001111
0111111110
0110000101
0110111110
0110110010
0101110110
0101000010
0101111000
0110001110
0100001110
0100111011
1011000001
1011111000
1011111000
1001110010
1010000111
1010110111    
1010001000
1000111000
1011001111
1011111101
1010001011
1010111001
1101000111
1101110101
1100000011
1100110001
1100111111
1111001101
1111111011
1110001001

Note that the middle two bits are always the same, and the high
order bits seem to be changing slowly, but slowly upwards.

My guess is that some value is being added to the plaintext character,
and this value is incremented every plaintext character.  Further,
perhaps, there is a exclusive or being performed.  In any case, I hope
that this gets other people moving in the right direction.  
Suggested words to look for, that seem to have tweaked the nanny, are
xenu hemet zinjifar helena kobrin mark ingber grady ward mirele
rnewman wollersheim andreas heldal-lund operation clambake
"gilman hot springs" motherfucker cocksucker