Hex, Base64, and XOR in code

02Hex and Base64 show bytes; XOR changes them

In the script, bytes.fromhex reads the supplied pair list into a bytes value. Indexing that value, as in data[0], returns an integer for one byte. Index zero selects the first byte; data[1] and data[2] select the next two. Those integers are suitable operands for ^.

The script stores the transformed integers in first, second, and third. print displays integers in decimal by default. A hex result such as 4c and decimal 76 therefore describe the same value, not different transforms.

Base64 is separate from XOR. Python’s base64.b64encode represents bytes with the standard alphabet; it does not apply the key. In a displayed value such as b'bGFi', the leading b and quotes mark Python’s bytes representation. The Base64 characters themselves are bGFi. The supplied XOR script does not call that Base64 function.

03Transform three bytes, then reverse them

Use the complete input display 6c 61 62 and key 0x20. The bytes spell lab under UTF-8. The input.bin download contains the same three raw bytes, but the printed pair list supplies all evidence needed here.

YanoSec / Code
Three activity bytes. Not an observed program dump.
6c 61 62
Key byte: 20
Predicted first XOR, hex: 4c 41 42
Predicted decimal print of those integers: 76 65 66
Predicted second XOR with the same key, hex: 6c 61 62
Predicted decimal print: 108 97 98
The second hex line matches the starting bytes.
Standard Base64 of the starting bytes: bGFi
Keep the byte values separate from the representation used to print them.

key = 0x20
data = bytes.fromhex("6c 61 62")
first = data[0] ^ key
second = data[1] ^ key
third = data[2] ^ key
print(first, second, third)
print(first ^ key, second ^ key, third ^ key)

1. Write 0x20 as 0010 0000. For each input byte, compare the eight bit positions with that key. The key changes the bit whose place value is 32 and leaves the other positions unchanged.
2. Compare your first-pass values with hex 4c 41 42. In decimal those are 76, 65, and 66, the values on the first print line.
3. Apply 0x20 to each result again. Check: 6c 61 62, or decimal 108, 97, and 98. Match this to the script’s second print line. The same key undoes each earlier change.
4. Record both representations, then stop. A prior Python 3.12.3 run recorded 76 65 66 followed by 108 97 98. A separate Base64 call returned bGFi for the starting bytes. Later, in a fresh lab directory, python3 xor-demo.py can display the XOR lines; it writes no file.

04Optional challenge

For about ten extra minutes, apply key 0 to 0x41. A zero key leaves every bit as it was: 0 XOR 0 gives 0 and 1 XOR 0 gives 1. Check that the resulting byte is still 0x41. Explain why leaving a value unchanged adds no protection.

05Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

data = bytes.fromhex("52 17")
key = 0x0f
first = data[0] ^ key
second = data[1] ^ key
restored = first ^ key
XOR outputs 1 when the two aligned bits differ, 0 when equal.
52 = 01010010; 17 = 00010111; 0f = 00001111.

A reader receives XOR-transformed bytes together with the complete one-byte key and the statement that the same key was applied to each byte. The result is then represented as Base64.

06Explain your prediction

Optional written self-check: Show which index supplies each byte and retain eight-bit alignment. Explain reversible XOR and public Base64 as separate steps; source predictions are not evidence of a run.