ebCTF 2013: "MD5 Colliding" 400 pts [Hexcellents CTF Wiki]

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
= ebCTF 2013: "MD5 Colliding" 400 pts =

Writeup author: **Radu Caragea**

----

Task text:
<code>
Please upload 5 Windows console executable files with the same MD5 but with different printed outputs (file type: MS Windows, PE32 executable, console)

The output for the files should be:
File1: All Eindbazen are wearing wooden shoes
File2: All Eindbazen live in a windmill
File3: All Eindbazen grow their own tulips
File4: All Eindbazen smoke weed all day
File5: All Eindbazen are cheap bastards

NOTE: The goal of this challenge is NOT to attack this webservice, this is NOT a WEB challenge.
</code>

First of all I'm not really a crypto person so I learned a lot during this challenge which, unfortunately, I didn't manage to finish during the contest.
The first attempt was to use some sort of derivative of the evilize proof-of-concept tool [[http://www.mscs.dal.ca/~selinger/md5collision/]] which produces 'good' and 'evil' binaries that each do something else by replacing some blocks inside the binary. It didn't seem to scale for more than 2 outputs so I had to find something else. Hashclash [[http://code.google.com/p/hashclash/]] seemed like a good alternative but it took about 4 hours for one collision so this clearly wasn't the intended solution.
The approach that yielded success was the one presented at [[http://cryptography.hyperlink.cz/MD5_collisions.html]], which can produce blocks that collide into the same MD5.

The usefulness of collision blocks is that, because of the M-D construction, you have the following:
<code>
If MD5(BlockA) = MD5(BlockB)  (even if SHA1(BlockA) != SHA1(BlockB) )
Given any binary data D: MD5(BlockA + D) = MD5(BlockB + D) (where + is the concatenation operator)
</code>
(This means that we could create an executable and append it to the 2 collision blocks and have 2 new executables with the same MD5 but unfortunately these wouldn't respect the PE format so they wouldn't run)

However, the converse is not true:
<code>
If MD5(BlockA) = MD5(BlockB)  (even if SHA1(BlockA) != SHA1(BlockB) )
Given any binary data D, usually: MD5(D + BlockA) != MD5(D + BlockB) (where + is the concatenation operator)
</code>
Why is this the case? The reason is that the collision blocks were created using an IV that does not coincide with the md5 digest of the data D. Fortunately, we can give the program that creates collisions arguments to set up the IV. This means that we can have 2 executables that are identical except for a final appended block (but still have the same MD5). To setup the IV from a file I used the following:
<file c partial_md5.c>
#include <stdio.h>
#include <openssl/md5.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <stdlib.h>
#include <fcntl.h>

int main(int argc, char **argv)
{
	int fin;
	struct stat st;
	void *p = NULL;
	MD5_CTX ctx;
	unsigned char final[16];

	if (argv[1] == NULL) {
		printf("./partial_md5 </path/to/file>\n");
		exit(-1);
	}

	fin = open(argv[1], O_RDONLY);
	if (fin < 0 ) {
		printf("Can't open %s\n", argv[1]);
		exit(-1);
	}
	stat(argv[1], &st);
	if (st.st_size % 64 != 0) {
		printf("Filesize is not a multiple of blocksize (64B)!\n");
		printf("Pad it with %ld more bytes!\n", 64 - (st.st_size % 64) );
		exit(-1);
	}

	p = mmap(NULL, st.st_size, PROT_READ, MAP_PRIVATE, fin, 0);
	if (!p) {
		printf("Mmap failed\n");
		exit(-1);
	}

	MD5_Init(&ctx);
	MD5_Update(&ctx, p, st.st_size);

	printf("Partial MD5 is %08X %08X %08X %08X\n", ctx.A, ctx.B, ctx.C, ctx.D);
	MD5_Final(final, &ctx);

	printf("Final MD5 is %08X %08X %08X %08X\n", ctx.A, ctx.B, ctx.C, ctx.D);

	return 0;
}
</file>
This can be made to scale relatively easily:
<code>
Given any binary data D:

Generate 2 collision block suffixes: A1 and A2:
    MD5(D + A1) =
    MD5(D + A2)
Generate 2 more collision block suffixes: B1 and B2:
    MD5(D + A1 + B1) = 
    MD5(D + A2 + B1) = 
    MD5(D + A1 + B2) = 
    MD5(D + A2 + B2)
    (once the md5 compression function is applied to either D+A1 or D+A2 it yields the same thing
Generate 2 more collision block suffixes C1 and C2:
    MD5(D + A1 + B1 + C1) = 
    MD5(D + A2 + B1 + C1) = 
    MD5(D + A1 + B2 + C1) = 
    MD5(D + A2 + B2 + C1) = 
    MD5(D + A1 + B1 + C2) = 
    MD5(D + A2 + B1 + C2) = 
    MD5(D + A1 + B2 + C2) = 
    MD5(D + A2 + B2 + C2)
</code>
So you can have N collisions with logN collision block generation calls.
A quick and dirty solution is to create an executable that prints the requested strings according to the executable name. Uploading this to the site will satisfy the conditions: different SHA1 sums but equal MD5 sums. However, there is no guarantee that the executables preserve their given names.

A more complex solution that actually leads to something resembling the 'evilize' tool is one that makes the collisions inside the binary rather than at the end.

<file c base.c>
#include <stdio.h>
        /* this initialization doesn't work with cl.exe, only gcc. */
        //unsigned char buff[] = { [0 ... 4095] = 0x69};
        
	unsigned char buff[4096] = "iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii";
	int magic_pos1 = 0xDEADBEEF;
	int magic_pos2 = 0xDEADCAFE;
	int magic_pos3 = 0xDEADBABE;


	int magic_byte1 = 0x31415925;
	int magic_byte2 = 0x12344321;
	int magic_byte3 = 0xABCDDABC;

int main()
{
	int *buffer = (int *)buff;
	if(buffer[magic_pos1] == magic_byte1 && buffer[magic_pos2] == magic_byte2 && buffer[magic_pos3] == magic_byte3 )
		puts("All Eindbazen are wearing wooden shoes");
	if(buffer[magic_pos1] == magic_byte1 && buffer[magic_pos2] == magic_byte2 && buffer[magic_pos3] != magic_byte3 )
		puts("All Eindbazen live in a windmill");
	if(buffer[magic_pos1] == magic_byte1 && buffer[magic_pos2] != magic_byte2 && buffer[magic_pos3] == magic_byte3 )
		puts("All Eindbazen grow their own tulips");
	if(buffer[magic_pos1] == magic_byte1 && buffer[magic_pos2] != magic_byte2 && buffer[magic_pos3] != magic_byte3 )
		puts("All Eindbazen smoke weed all day");

	if(buffer[magic_pos1] != magic_byte1 && buffer[magic_pos2] == magic_byte2 && buffer[magic_pos3] == magic_byte3 )
		puts("All Eindbazen are cheap bastards");

	if(buffer[magic_pos1] != magic_byte1 && buffer[magic_pos2] == magic_byte2 && buffer[magic_pos3] != magic_byte3 )
		puts("Mos Craciun si prietenii sai");

	if(buffer[magic_pos1] != magic_byte1 && buffer[magic_pos2] != magic_byte2 && buffer[magic_pos3] == magic_byte3 )
		puts("To be or not to be");

	if(buffer[magic_pos1] != magic_byte1 && buffer[magic_pos2] != magic_byte2 && buffer[magic_pos3] != magic_byte3 )
		puts("That is the question");

	return 0;
}
</file>

**Note**: magic_byte should actually be magic_dword, initially I didn't have everything scripted
Having a large enough buffer means that we can insert the three collision blocks inside it after compile time without any issues. The binary is thus split in three parts:
  * The prefix: everything before the signature (the buffer)
  * The signature
  * The suffix

The key here is that we can use the previous approach to create 8 signatures that collide into the same MD5 when appended to the prefix. After that we can add absolutely anything to the suffix (or modify it) and the collisions are preserved. This is where the magic values come in handy, we can select what output to print by replacing them with suitable values.

<code bash>

root@dmns:x86_64 [example] # ./split_replace.py base.exe
First three arguments should be </path/to/main_exec> <signature byte (e.g 69)> <signature byte count>
root@dmns:x86_64 [example] # ./split_replace.py base.exe 69 4096
Wrote base.exe.prefix
Now run ./suffix_collision.sh base.exe.prefix

root@dmns:x86_64 [example] # ../suffix_collision.sh base.exe.prefix
[*] Creating two suffix blocks that collide into the same MD5 for the prefix [base.exe.prefix]
Partial MD5 is D9C1930D E11B6193 AE34C75F C4072C43
Final MD5 is 312D1F08 8A337C8E 67FABB21 66F2D2B0
[*] Removing previous collisions
[*] Starting collision search

Init vector : 0xD9C1930D,0xE11B6193,0xAE34C75F,0xC4072C43

Start from X=344122AB ...
Generating block 1 ...

 The first block collision took  : 1.070000 sec
Block 1 to disk: 0
Block 2 to disk: 0

 The second block collision took  : 0.080000 sec
 The first and the second blocks together took : 1.150000 sec
Generation completed.
mkdir: cannot create directory 'base.exe.prefix.collision': File exists
[*] Done.
[*] Testing to see if it actually worked
First difference is at offset X and has value Y
-0000010: 8b7dbe4c  .}.L
e667a52e91b05ae5306638f9d4261289  base.exe.prefix.collision/binary_A
e667a52e91b05ae5306638f9d4261289  base.exe.prefix.collision/binary_B



root@dmns:x86_64 [example] # ../suffix_collision.sh base.exe.prefix.collision/binary_A
[*] Creating two suffix blocks that collide into the same MD5 for the prefix [base.exe.prefix.collision/binary_A]
Partial MD5 is 8299ACA2 B8587451 89614383 6C1B057D
Final MD5 is 2EA567E6 E55AB091 F9386630 891226D4
[*] Removing previous collisions
[*] Starting collision search

Init vector : 0x8299ACA2,0xB8587451,0x89614383,0x6C1B057D

Start from X=34624688 ...
Generating block 1 ...

 The first block collision took  : 4.780000 sec
Block 1 to disk: 0
Block 2 to disk: 0

 The second block collision took  : 0.590000 sec
 The first and the second blocks together took : 5.370000 sec
Generation completed.
[*] Done.
[*] Testing to see if it actually worked
First difference is at offset X and has value Y
-0000010: c52e5463  ..Tc
66eddd0eb32a970940025189fe461bf1  base.exe.prefix.collision/binary_A.collision/binary_A
66eddd0eb32a970940025189fe461bf1  base.exe.prefix.collision/binary_A.collision/binary_B


root@dmns:x86_64 [example] # ../suffix_collision.sh base.exe.prefix.collision/binary_A.collision/binary_A
[*] Creating two suffix blocks that collide into the same MD5 for the prefix [base.exe.prefix.collision/binary_A.collision/binary_A]
Partial MD5 is 9C2E3256 5B66CB52 9EDC29AC 38CBB1DF
Final MD5 is 0EDDED66 09972AB3 89510240 F11B46FE
[*] Removing previous collisions
[*] Starting collision search

Init vector : 0x9C2E3256,0x5B66CB52,0x9EDC29AC,0x38CBB1DF

Start from X=34836A64 ...
Generating block 1 ...

 The first block collision took  : 1.890000 sec
Block 1 to disk: 0
Block 2 to disk: 0

 The second block collision took  : 2.700000 sec
 The first and the second blocks together took : 4.590000 sec
Generation completed.
[*] Done.
[*] Testing to see if it actually worked
First difference is at offset X and has value Y
-0000010: f75d56da  .]V.
b5146c88229f4f401b780cade203a639  base.exe.prefix.collision/binary_A.collision/binary_A.collision/binary_A
b5146c88229f4f401b780cade203a639  base.exe.prefix.collision/binary_A.collision/binary_A.collision/binary_B
</code>

This has created 3 pairs of suffixes. The first one differed from the second at position 0x10, having the value 8b7dbe4c, the next one at position 0x10, having the value c52e5463 and the third one at position 0x10, having the value f75d56da. The blocks have each 128 bytes == 0x80, so the actual offsets from the beginning of the buffer are:
  * 0x00000010 8b7dbe4c
  * 0x00000090 c52e5463
  * 0x00000110 f75d56da

What remains is just a simple pattern search and replace:
  * The offsets
    * 0xDEADBEEF (efbeadde) with 0x00000010/4 (because the buffer is declared as int *)
    * 0xDEADCAFE (fecaadde) with 0x00000090/4
    * 0xDEADBABE (bebaadde) with 0x00000110/4
  * The values
    * 0x31415925 with 8b7dbe4c
    * 0x12344321 with c52e5463
    * 0xABCDDABC with f75d56da

<code bash>
root@dmns:x86_64 [example] # ../multiplex.sh 8b7dbe4c c52e5463 f75d56da
mkdir: cannot create directory 'output': File exists
Signature left is now 3968 bytes long
Wrote prefix + collision block + rest of signature to output/A__
Signature left is now 3968 bytes long
Wrote prefix + collision block + rest of signature to output/B__
Signature left is now 3840 bytes long
Wrote prefix + collision block + rest of signature to output/AA_
Signature left is now 3840 bytes long
Wrote prefix + collision block + rest of signature to output/AB_
Signature left is now 3840 bytes long
Wrote prefix + collision block + rest of signature to output/BB_
Signature left is now 3840 bytes long
Wrote prefix + collision block + rest of signature to output/BA_
Signature left is now 3712 bytes long
Wrote prefix + collision block + rest of signature to output/AAA
Signature left is now 3712 bytes long
Wrote prefix + collision block + rest of signature to output/AAB
Signature left is now 3712 bytes long
Wrote prefix + collision block + rest of signature to output/ABA
Signature left is now 3712 bytes long
Wrote prefix + collision block + rest of signature to output/ABB
Signature left is now 3712 bytes long
Wrote prefix + collision block + rest of signature to output/BAA
Signature left is now 3712 bytes long
Wrote prefix + collision block + rest of signature to output/BAB
Signature left is now 3712 bytes long
Wrote prefix + collision block + rest of signature to output/BBA
Signature left is now 3712 bytes long
Wrote prefix + collision block + rest of signature to output/BBB
Magic patching output/AAA
Patching efbeadde with 04000000
Patching fecaadde with 24000000
Patching bebaadde with 44000000
Patching 25594131 with 8b7dbe4c
Patching 21433412 with c52e5463
Patching bcdacdab with f75d56da
Magic patching output/AAB
Patching efbeadde with 04000000
Patching fecaadde with 24000000
Patching bebaadde with 44000000
Patching 25594131 with 8b7dbe4c
Patching 21433412 with c52e5463
Patching bcdacdab with f75d56da
Magic patching output/ABA
Patching efbeadde with 04000000
Patching fecaadde with 24000000
Patching bebaadde with 44000000
Patching 25594131 with 8b7dbe4c
Patching 21433412 with c52e5463
Patching bcdacdab with f75d56da
Magic patching output/ABB
Patching efbeadde with 04000000
Patching fecaadde with 24000000
Patching bebaadde with 44000000
Patching 25594131 with 8b7dbe4c
Patching 21433412 with c52e5463
Patching bcdacdab with f75d56da
Magic patching output/BAA
Patching efbeadde with 04000000
Patching fecaadde with 24000000
Patching bebaadde with 44000000
Patching 25594131 with 8b7dbe4c
Patching 21433412 with c52e5463
Patching bcdacdab with f75d56da
Magic patching output/BAB
Patching efbeadde with 04000000
Patching fecaadde with 24000000
Patching bebaadde with 44000000
Patching 25594131 with 8b7dbe4c
Patching 21433412 with c52e5463
Patching bcdacdab with f75d56da
Magic patching output/BBA
Patching efbeadde with 04000000
Patching fecaadde with 24000000
Patching bebaadde with 44000000
Patching 25594131 with 8b7dbe4c
Patching 21433412 with c52e5463
Patching bcdacdab with f75d56da
Magic patching output/BBB
Patching efbeadde with 04000000
Patching fecaadde with 24000000
Patching bebaadde with 44000000
Patching 25594131 with 8b7dbe4c
Patching 21433412 with c52e5463
Patching bcdacdab with f75d56da
</code>

And the final verification:
<code bash>
root@dmns:x86_64 [example] # for i in `ls output/*magic_fixed`; do md5sum $i; done
73ed3d82cbdcb61ff41e1791e28c91e9  output/AAA.magic_fixed
73ed3d82cbdcb61ff41e1791e28c91e9  output/AAB.magic_fixed
73ed3d82cbdcb61ff41e1791e28c91e9  output/ABA.magic_fixed
73ed3d82cbdcb61ff41e1791e28c91e9  output/ABB.magic_fixed
73ed3d82cbdcb61ff41e1791e28c91e9  output/BAA.magic_fixed
73ed3d82cbdcb61ff41e1791e28c91e9  output/BAB.magic_fixed
73ed3d82cbdcb61ff41e1791e28c91e9  output/BBA.magic_fixed
73ed3d82cbdcb61ff41e1791e28c91e9  output/BBB.magic_fixed
root@dmns:x86_64 [example] # for i in `ls output/*magic_fixed`; do wine $i; done
All Eindbazen are wearing wooden shoes
All Eindbazen live in a windmill
All Eindbazen grow their own tulips
All Eindbazen smoke weed all day
All Eindbazen are cheap bastards
Mos Craciun si prietenii sai
To be or not to be
That is the question
</code>