DataWedge session decryption

dw_decrypt.py

#!/usr/bin/env python3

from Crypto.Cipher import DES3
from Crypto.Hash import SHA1

from hexdump import hexdump

def sha1(data):
	return SHA1.new(data).digest()

def des3_encrypt_cbc(key, iv, data):
	crypto = DES3.new(key, DES3.MODE_CBC, iv)
	return crypto.encrypt(data)

def des3_decrypt_cbc(key, iv, data):
	crypto = DES3.new(key, DES3.MODE_CBC, iv)
	return crypto.decrypt(data)

def xor_bytes(s1, s2):
	return bytes(a ^ b for (a, b) in zip(s1, s2))

def trim_pad(s):
	if not s:
		return b''
	c = s[-1]
	pad = bytearray([c] * c)
	return s[:-c] if s.endswith(pad) else s

in_data = bytes.fromhex('991136E3E3BD0F873B4A564E37385BF5')

seed = bytes.fromhex('31437400CA26B505CBAC727F2DE59657408E9F0F193F6360EB59187BF67568FA')
iv = bytes.fromhex('31437400CA26B505')

h = sha1(seed).ljust(64, b'\0')
a = xor_bytes(h, b'\x36' * 64)
b = xor_bytes(h, b'\x5C' * 64)
key = sha1(a) + sha1(b)[:4]

out_data = trim_pad(des3_decrypt_cbc(key, iv, in_data))

hexdump(out_data)