In our last article, we mentioned how Regular Expressions can help us find keywords in codes and possibly help us turn it into passcodes.

Here’s a quick review of the special characters we’ll be using:

• ^ means to match the beginning of a string of text
• \$ means to match the end of a string of text
• [ and ] are used to match a single character that is enclosed within it.
• { and } are used to specify how many of the previous character (special or not) to match.
• . means to match any character
• + means to match the previous character (special or not special) at least once
• ( and ) are used to group together characters to be recalled further in the search

## Transposition Example

`ee4el5eiysn3qt3`

15 characters in the code, using the current pattern [2-9][a-z][a-z][a-z][2-9]keyword[a-z][2-9][a-z][2-9][a-z]:

`^[ee4el5eiysn3qt3]{5}\$`

Searching for the pattern in our keyword finder, we see 3 results:

• elint
• intel
• stein

When given more than one result from the keyword search tool, do the first step of the transposition and find which one is the likeliest keyword.

Let’s see what we get when we break up the code into rectangles

```ee4
el5
eiy
sn3
qt3```
```ee4el
5eiys
n3qt3```

The top one has elint in the 2nd column but the code does not fit the pattern reading down from the top-left corner.

Reversing the 1st, 3rd, and 5th rows:

```4ee
el5
yie
sn3
3tq```

Now when you read downwards from the top-left corner:

`4eys3elinte5e3q`

## Non-Transposition Example

Transposition will not always be the method to use solve these.

`5zvq3oyeaywt4y7w`

16 characters with the same format

`^[5zvq3oyeaywt4y7w]{6}\$`

We have 0 results. If you look carefully, this code is already in the proper passcode format. It actually uses the substitution method:

`^.(.)..\1.\$`

We get 5 results:

• covcom
• evolve
• follow
• hannah
• pursue

Pursue is the only word that does not have other matching letters:

```o y e a y w
p u r s u e```

On careful inspection, the letters are next to each other on a QWERTY keyword. Shifting each letter from the code to the right:

`6xbw4pursuey5u8e`

## Another Substitution Example

`5576778b536b7561886d61836d5572546c`

The length of the code is 34, grouping the characters into twos gives us 17 pairs.

`55 76 77 8b 53 6b 75 61 88 6d 61 83 6d 55 72 54 6c`

Separating this into prefix, keyword, and suffix pieces:

```Prefix: 55 76 77 8b 53
Keyword: 6b 75 61 88 6d 61 83
Suffix: 6d 55 72 54 6c```

Tip: compare the position of numbers to where they are in the passcode format, if they share a characteristic (in this case, they all begin with 5 and nothing else does), it’s very likely substitution is the method to use.

We’ll need to figure out the keyword to figure out how to reverse engineer how the pairs correlate to letters and numbers used in the passcode

Keyword regex pattern

`^..(.)..\1.\$`

We are assuming each pair of characters match up to a particular letter so the 61 in the 3rd position matches the 61 in the 6th position.

• chapeau
• ezekiel
• forward

Our assumption is that the only pairs that match are the 3rd and 6th character, so ezekiel is not a candidate.

chapeau and forward remain, looking at their ASCII values:

`keyword: 6b 75 61 88 6d 61 83`
```chapeau: 67 72 65 80 69 65 85
forward: 70 79 82 87 65 82 68```

chapeau’s first character matches the keyword’s first character in each of the pairs so it’s likely chapeau is the keyword and it’s a play on the ASCII values.

Looking at the pairs, we see that for some numbers, the keyword’s left character is subtracted from the right character and that matches chapeau:

```75: 7 - 5 = 2
61: 6 - 1 = 5
88: 8 - 8 = 0```

Incidentally, for the other ones, adding the two characters using hex values and taking the modulus 10 seem to work:

```6b: 6 + b (11) = 17 % 10 = 7
6d: 6 + d (13) = 19 % 10 = 9```

Applying this formula to the prefix and suffix:

`Prefix: 55 76 77 8b 53`
```55: 5 - 5 = 0: 50
76: 7 - 6 = 1: 71
77: 7 - 7 = 0: 70
8b: 8 + b (11) = 19: 89
53: 5 - 3 = 2: 52```
`2gfy4`
`Suffix: 6d 55 72 54 6c`
```6d: 6 + d (13) = 19: 69
55: 5 - 5 = 0: 50
72: 7 - 2 = 5: 75
54: 5 - 4 = 1: 51
6c: 6 + c (12) = 18: 68```
`e2k3d`
`2gfy4chapeaue2k3d`

## Image Substitution Example

Not all substitution codes will be text based:

Note: This is an older code with a different passcode format:

`[2-9][p-z][p-z][a-h][2-9]keyword[p-z][2-9][2-9][2-9][p-z]`

Transcribing what we see:

• R = Red
• Y = Yellow
• B = Blue
• M = Magenta
• _ = background colour
```Prefix:
R_____YB
_R_B__Y_
_RB___Y_
_R_BY___
R____BY_```
```Keyword:
BR____Y_
_M__Y___
_R___YB_
_R__G___
_R___Y_B
_RB___Y_
_M__Y___```
```Suffix:
_R___BY_
R____BY_
M______Y
R__B__Y_
_M____Y_```

The keyword can be looked up with a regex:

`^.(.)....\1\$`

It will give us 5 results:

• message
• mystery
• nagassa
• pandora
• samsara

We remove results which have other matching characters leaving us with:

• mystery
• pandora

Lining up the letters to the keyword part of the transcription:

```BR____Y_ m/p
_M__Y___ y/a
_R___YB_ s/n
_R__G___ t/d
_R___Y_B e/o
_RB___Y_ r/r
_M__Y___ y/a```

Looking at the 3rd and 5th letter of the keyword carefully:

```_R___YB_ s/n
_R___Y_B e/o```

It looks like the B has shifted only 1 position with everything else staying the same, n and o are next to each other in the alphabet. pandora seems to be the likely candidate for the keyword.

p is next to o in the alphabet and r is close to p, let’s examine their transcribed relationship:

```_R___Y_B o
BR____Y_ p
_RB___Y_ r```

The B was at the end of the line for o and shifted to the beginning for p. The R stayed in the same position but the Y moved one position to the right. Likewise, the B for r is two positions away from the B for p.

The two remaining characters are a and d:

```_M__Y___ a
_R__G___ d```

There aren’t any B’s here but there are only 2 colours in these lines compared to the 3 for n, o, p, and r.

Yellow and Blue make Green. Red and Blue make Magneta. That’s where the missing B’s went.

Noting the positions of R, Y, and B in pandora:

```01234567    R Y B
BR____Y_ p  1 6 0
_M__Y___ a  1 4 1
_R___YB_ n  1 5 6
_R__G___ d  1 4 4
_R___Y_B o  1 5 7
_RB___Y_ r  1 6 2
_M__Y___ a  1 4 1```

RYB matches the octal representation of the word pandora: (160 141 156 144 157 162 141):

Completing the prefix and suffix:

```Prefix:    R Y B
R_____YB   0 6 7
_R_B__Y_   1 6 3
_RB___Y_   1 6 2
_R_BY___   1 4 3
R____BY_   0 6 5

067 163 162 143 065```
```Suffix:    R Y B
_R___BY_   1 6 5
R____BY_   0 6 5
M______Y   0 7 0
R__B__Y_   0 6 3
_M____Y_   1 6 1
165 065 070 063 161```
`7src5pandorau583q`

We have shown that regular expressions can be used to help us look for keywords in codes. From there, it will help us get a better understanding of the steps needed to convert the code into a passcode.

Regular Expressions aren’t only useful for passcode solves. They are used in the real world for searching and replacing text in a document. Here’s a link to a XKCD comic that explores one such “real world” scenario.

# What’s Next?

We’ll be going back to our regular decoding walkthroughs but we’ll take a quick look at which social media accounts to follow to be sure you won’t miss a code.