El Capo 2 Cap 57 ⟶

T[i] = rotl8( key[i] ^ 0x5A , i % 8 ) We want Σ T[i] = 0xdeadbeef (mod 2^32) . Because the checksum is a simple sum, we can freely pick the first 63 bytes and solve for the last byte.

def rotl8(v, r): return ((v << r) | (v >> (8 - r))) & 0xFF def inv_rotl8(v, r): return ((v >> r) | (v << (8 - r))) & 0xFF el capo 2 cap 57

#!/usr/bin/env python3 import subprocess, os, struct T[i] = rotl8( key[i] ^ 0x5A , i