Reconstruction of des.exe/undes.exe

README.md

@@ -1,3 +1,38 @@
-# des_undes
+# DES/UNDES V1.1.0 source reconstruction — v2
 
-Old des/undes code based on libdes-3.14.
+This directory contains a revised C reconstruction of `des.exe` and
+`undes.exe` after comparison with the original `cryptl99.zip` dependency.
+
+## Main files
+
+- `des.c` — reconstructed encryption program
+- `undes.c` — reconstructed decryption program
+- `des_common.c`, `des_common.h` — reconstructed common support
+- `reconstruction-notes.md` — evidence, file format and remaining uncertainty
+- `cryptlib-api-map.md` — exact CRYPTLIB 0.99 function mapping
+- `validation.md` — build/round-trip sanity check
+- `asm/` — disassembly used for the reconstruction
+- `third_party/cryptl99.zip` — user-supplied original archive
+- `third_party/cryptlib-0.99/` — extracted dependency source
+
+## What changed from the first reconstruction
+
+The supplied CRYPTLIB source resolves several earlier uncertainties and one
+important mistake:
+
+1. The real API names are lower-case (`initLibrary`,
+   `queryAlgoModeInformation`, `retrieveIV`, etc.).
+2. The executable uses `CRYPT_ALGO_3DES`, not `CRYPT_ALGO_DES`.
+3. The mode is `CRYPT_MODE_CBC`.
+4. The effective queried key size is 14 bytes.
+5. The queried/stored IV is 4 bytes, not 8 bytes.
+6. The archive contains exactly libdes 3.14, matching the embedded executable
+   version string.
+
+## Status
+
+The control flow and file-format reconstruction is high confidence.  The code
+is intended primarily as a faithful readable reconstruction.  It has not been
+claimed to be byte-for-byte recompilable to the original executables because
+that would require the exact original compiler flags, source layout, linker
+configuration and original identifiers.