Crypto / Decode Playbook

# Ciphey — original (Python, slowed maintenance)
ciphey -t "$CIPHERTEXT"

# Ares — Rust rewrite (faster, current)
ares -t "$CIPHERTEXT"

hashid -m '$2a$12$....'             # bcrypt 12 rounds
hashid -m '5f4dcc3b5aa765d61d8327deb882cf99'  # MD5
hash-identifier

# JWT
echo $TOKEN | cut -d. -f1-2 | tr '_-' '/+' | base64 -d 2>/dev/null

# Hex → bytes
echo "$HEX" | xxd -r -p

# Base64 → bytes (handle URL-safe)
echo "$B64" | tr '_-' '/+' | base64 -d 2>/dev/null

# Multi-encoded (unwind layers)
echo "$BLOB" | base64 -d | base64 -d | xxd -r -p

# Common chains
"From Base64 / Magic / To Hex"
"From Hex / XOR (Brute) / Magic"
"AES Decrypt(KEY) / From Hex / Strings"

hashcat -m <mode> hashes.txt rockyou.txt -r best64.rule
john --format=<format> hashes.txt --wordlist=rockyou.txt

1. ciphey/ares → reveal base layer
2. If structured (JSON / proto3 / msgpack) → parse
3. If still encoded → repeat step 1
4. Look for HMAC / signature suffix → identify symmetric key candidates
5. If symmetric encryption suspected → try AES-CBC/GCM w/ common keys
   (app-name, "secret", env vars exposed elsewhere)

# decepticon/tools/crypto/decode.py — skeleton
def crypto_decode(ciphertext: str, hint: str = None, timeout: int = 30) -> dict:
    """Try ares first (fast), fallback to ciphey, return best decode."""
    import subprocess
    cmd = ["ares", "-t", ciphertext]
    if hint:
        cmd += ["--language", hint]
    r = subprocess.run(cmd, timeout=timeout, capture_output=True, text=True)
    return {
        "tool": "ares",
        "output": r.stdout,
        "confidence": _parse_ares_confidence(r.stdout),
    }

kg_add_node(kind="artifact", label=f"decoded:{hash}",
            props={"plaintext": result, "encoding_chain": chain})