From 8bcd48e6187e5bb379b2dfa746674d399af12435 Mon Sep 17 00:00:00 2001 From: liquidsec Date: Mon, 16 Mar 2026 16:07:58 -0400 Subject: [PATCH] Document anchorBlock IV mode in example.ini --- example.ini | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/example.ini b/example.ini index e4014dc..538e1d4 100644 --- a/example.ini +++ b/example.ini @@ -68,7 +68,9 @@ cookies = {} # 'firstblock'. This mode assumes that the first block of the ciphertext is the IV (most common) # 'knownIV'. This mode allows for user provided IV # 'unknown'. Use this mode when you do not know the IV and it is not the first block but still wish to decrypt all but the first block, or re-encrypt all but the first block for encryption -# 'lastblock'. This has not been implemented yet, but it may be in the future as it is a rare but possible configuration +# 'anchorBlock'. Use this mode when you have a separate, known-valid ciphertext whose first block +# should be used as the IV/anchor. This is useful for encryption mode when you need a valid first +# block from an existing ciphertext to anchor the new encrypted payload. Requires anchorCiphertext. # choose from one of the above modes @@ -77,6 +79,10 @@ ivMode = firstblock #IV should be in decimal list format. For example: [72,65,82,65,77,66,69] iv = [0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] +# If using anchorBlock mode, specify the anchor ciphertext (encoded in the same format as encodingMode) +# The first block of this ciphertext will be extracted and used as the IV. +anchorCiphertext = + # The oracle defines the information leak that is abused to know when padding is valid. This is typically an error message. # There are several trigger modes depending on the situation. Sometimes you will want to look for a specific phrase, other times you want to look for an absence of that phrase.