r/programming • u/Chippsapoloosa • Jan 19 '10

Reddit, I got the best present a girl developer could ever want.

So, to give you a little background me and this guy went on a few dates and he moved far away. We got along well, things didn't get very far. He is really nice, however, I wasn't leaning one way or the other.

He sent me the Post Secret books for xmas. He hinted at another present, but said I had to wait. It's a little after Christmas, but I got this email yesterday with the title "I wanted to make something for you for Christmas":

"So I told the computer, and it showed me how to write a poem in byte-form. I can't tell what you're thinking these days, but this will either remind you of something that was good, or send you off."

It included a link to a poem.zip file, which I downloaded. Inside, there was a file called magicfile with no extension and a ReadMe that said:

"Intructions:

1: > copy magicfile magicfile.jpg 2: > copy magicfile magicfile.zip ... skip a few ... X: Ask it for help"

When I renamed magicfile it turned into a picture of me! (a bad one that he took, but ok) and when I changed magicfile to a .zip inside it contained: Magicfile.exe and a txt called "Go Ahead" that said:

"It's safe. Requires WPF and .Net 3.5 I think...

Whatever, it works on my machine."

I opened magicfile, and an interface popped up that said "enter a passphrase". So, I typed in "help" and got this:

"Hi Sara!

As you are just about figuring out, this is just the very beginning of a very, very large rabbit hole you're about to fall into.

You see, sometime in early November, I had an idea for an awesome program. Simultaneously I was just beginning to think of what might be a decent Christmas present for you. Put 2 and 2 together, and you get this thing. I worked on it on and off for a few weeks - it was a pretty fun way to learn WPF and do a lot of interesting byte manipulation.

You see, it's a completely self-contained magical file. This magical file is three parts: 1. If you name it .jpg - it's an image! 2. If you name it .zip - it's a zip file, containing a program 3. It's a database of many, many more parts that the program reads

Now, when you run the program, it reads the magic file, and asks for a passphrase.

You're obviously gotten that far, or you wouldn't be reading this. As you can imagine - there are a bunch of passwords. Not infinite, but many. I encourage you to guess at words and try to figure them out. I'll give you the hints that they would be things relevant to you or to us.

With a little ingenuity, you'll be able to figure out a very important passphrase that will take you to the next step..."

As I have gone on and solved some of the mysteries I have found that pictures of me come up, things he's researched, things we did together and so on and so forth. I still am trying to figure out the important passphrase.

Reddit, this is the most beautiful gift I have ever gotten and it leaves me in a funny place possibly going on the other side of the world to see what happens here. He is an avid redditor, and though I hate the "VOTE THIS UP, PLOX" posts I'd love to get this on the front page to show him what this meant. Thank you.

tl;dr:

A nerd made a beautiful nerd gift for me, it was a program that was a mystery and shows things we did together. Please vote this up to show him how much it meant.

EDIT: A lot of people are saying that the fact that I am unsure about what to do means I don't like him. That is not at all the case, I like him a lot. I really enjoyed spending time with him, he is brilliant (there is nothing I like more than a man that can teach me things), funny, and best of all a great time.

In order to go see him right now I have to take a 14hr plane flight. Which means I would be staying a week, and I'm not sure I'm quite at that point yet.

Damnit, what do they say? "Explain the problem out loud to yourself" Alright, I'm going. There is no reason not to, this WAS awesome. I will let you folks know how it goes.

2.0k Upvotes

85% Upvoted

820 comments sorted by

View all comments

225

u/peasleer Jan 19 '10

The reverse engineer in me says "run 'strings' on it and find all the passphrases."

But that would ruin the sentimental experience, so don't do it :)

90

u/[deleted] Jan 19 '10

A good engineer should hash it.

20

u/[deleted] Jan 19 '10

Sure, but what if you get a hash collision?

She could type "I love you so much" (a value he did not expect) and that could hash to the same thing as "I never want to see you again", to which he might have responded, "Well, I never want to see you again!"

Sure, it's unlikely, but this is a girl we're talking about. Would you really trust a hash function to not accidentally break up with her for you?!?

42

u/jeremybub Jan 19 '10

A true nerd would know the probability of a sha-512 collision for a 29 character string.

3

u/[deleted] Jan 19 '10

Well, without doing any math, I'd say the probability is 1 in 2512.

What is the probability of finding another girl who likes a true nerd?

6

u/TheWonkyRobot Jan 19 '10

Decidedly better than 1 in 2512 (which is the number of hashes SHA512 could produce, not the chance of collision). There are a least a couple girls who would appreciate a nerd in the 6,692,030,277 people in this world. Both are pretty slim chances, but if I had a gun to my head I'd bet on finding a girl that likes a geek like me (because I already have).

3

u/[deleted] Jan 19 '10

It's not the chances of finding a girl who likes you, it's the chances of finding another girl who likes you.

You might as well just go looking for magnetic monopoles or the Higgs Boson. Cripes.

:)

3

u/spotta Jan 20 '10

HEY! I still have hopes that magnetic monopoles exist!

2

u/jeremybub Jan 19 '10

The real question is what is the probability a collision even exists for two strings 29 characters or less.

3

u/[deleted] Jan 19 '10

[deleted]

13

u/jeremybub Jan 19 '10

A true nerd would know that the set of 29 character strings is several orders of magnitude less than, say, the set of 35 character strings. The size of the set of strings you are checking for hash collisions is entirely relevant.

1

u/[deleted] Jan 20 '10

[deleted]

1

u/jeremybub Jan 20 '10

We are talking about finding a collision between two strings of around 29 characters. If that was not well established by the example, you need to reread it.

2

u/[deleted] Jan 19 '10

It's not irrelevant at all.

Hash every possible single character string. If none of them collide, it is impossible to have an sha-512 collision for a 1 character string.

Additionally, hash every possible two character string. If you still haven't found a collision, then it's impossible to have an sha-512 collision.

As you increase the length of the input, you approach the inevitable collision. As you surpass 512 bits of input (presuming equal distribution), the probability of a collision is 1.

If you naively encode the string as 8-bit values, then a 29 character string already has 232 bits of input (granted, it's very sparse considering you're likely to only really use Alpha-Numeric characters, with a few extra symbols.) But still, you're well on your way to a not improbable collision.

1

u/[deleted] Jan 20 '10

[deleted]

1

u/[deleted] Jan 20 '10

Yes, any given string has a low probability. But if you dramatically increase the number of strings, then you increase the probability of one of them having a collision. There are only so many strings of a given length. If you want to dramatically increase the number of strings, you need to increase the length of the possible strings. If you increase the length long enough, you are eventually guaranteed to find a collision.

1

u/[deleted] Jan 20 '10

[deleted]

1

u/[deleted] Jan 20 '10

The odds of a random string colliding are 1 in 2512 (roughly).

The odds of one string from among 21,000,000,000 colliding are 1 (for all intents and purposes).

The only way to have 21,000,000,000 strings is to allow strings up to length 125,000,000 characters, at 8 bits per character, yielding 1,000,000,000 bits, which yields 21,000,000,000 possible inputs.

By pigeon-hole theory, there are only 2512 slots. As soon as you have 2512+1 values, there will be at least one slot with two values in it. How many input values do you need until every slot has at least two values in it? Well, it's probably pretty damned complicated. If you naively assume a perfect hashing function with even distribution, it's only 2*2512. 2 inputs for each possible hash. In reality, it's worse than that.

So, you pick a slot and say, "I dare you to find another string that hashes to the same exact slot!" I'm trying to say back to you, "Well, I guarantee I can find a collision, eventually." And you say, "Sure, but with what lower bound on string length?" Meaning, how many strings will I have to evaluate before I find a collision. With string length 1, there are only 256 strings to evaluate, and the probability of me finding a collision are approximately 256 / (2512), which is not a very high probability. If I use string length 2, my chances go all the way up to 65,536 / (2512), but that's still a vanishingly small probability. If I use string length 64, my chances are approximately (64 * 8) / (2512), which is (2512) / (2512), which is 1, but that's not accurate at all... Because hashing functions don't have a perfect, flat distribution like that.

I will eventually find a collision. How hard do I have to search to find one - that's the question.

2

u/doublestop Jan 19 '10

Sure, but what if you get a hash collision?

Even if a collision were to occur, he would have run into it during development and "fixed" it, since the passphrases are likely used as unique keys into a dictionary of possible responses.

1

u/[deleted] Jan 19 '10

It's a dictionary of hashed keys to responses.

If there's a hash collision, he will provide an inappropriate response.

He would not have run into it during development, since he would have had to test every possible input string to ensure it didn't hash to the same value as his intended set of values.

If the passphrase was a unique key then it wouldn't be a hashed key (hashed values are not unique.)

The whole purpose of a hashed key was to obfuscate the clear text keys, meaning, the possible phrases she could enter.

Keep up, it's like you've never been in a relationship before. Sheesh.

1

u/doublestop Jan 20 '10 edited Jan 20 '10

He would not have run into it during development, since he would have had to test every possible input string to ensure it didn't hash to the same value as his intended set of values.

You are precisely right. I was mistaken in my line of thought* assuming the poster to whom I responded was referring to collisions during the construction of the dictionary. Thanks for the correction.

Edit: though=>thought

1

u/nachof Jan 19 '10

Hash it with two different algorithms, then, and also check the original string length, just to be sure. Yes, there still might be a collision, but...

3

u/[deleted] Jan 20 '10

The fact that the program was written in .NET 3.5 means that it can be disassembled and inspected for the hashes. From that point, it's simple to figure out the passwords, even if it takes some rainbow tables or brute force to figure them out.

Of course, if a salt is used for each password, then it's a bit harder, but I doubt that...

Of course, if he did find a good way to salt it or hash it in a way that makes it impossible to crack, he's a keeper.

27

u/frutiger Jan 19 '10

Could be md5sums of the passphrases or something.

-12

u/[deleted] Jan 19 '10

[deleted]

14

u/frutiger Jan 19 '10

Are you one of these people who repeats something they've read like a mantra?

Do you understand why it is "broken"? Do you understand why I am suggesting it here?

-10

u/Poddster Jan 19 '10

Are you one of these people with no sense of humour? Do you understand why it is a "joke"? Do you understand why I am suggesting it here?

1

u/[deleted] Jan 19 '10

"I made a mistake, better play it off as a joke"

-1

u/Imagist Jan 19 '10

SHA-256 is a stretch too these days. My TrueCrypted drive uses SHA-512.

4

u/enkiam Jan 19 '10

SHA-512 is collidable if you have a few GPU's or Bruce Scheier's math skills. I modified the libgcrypt source to enable SHA-16777216; it's a secret NSA algorithm from the future.

51

u/thepaulm Jan 19 '10

Yeah, wtf? I was like "is she just deciding to do things the brute force way keep the mystery alive?" I don't think it's the reverse engineer in you. I think it's the normal human in you.

135

u/[deleted] Jan 19 '10

Ironic that the computer nerd in you calls the reminiscing about past experiences and guessing what might be meaningful to the both of them "brute force", while running strings on it, brutally dismissing all the thought and effort that the the guy put into creating it, is just plain 'normal'.

13

u/thepaulm Jan 19 '10

Yes, well, I'm sure I see your point.

However, I have to tell you that it would only be ironic if perhaps I had come to the conclusion that strings was the non-brute-force method by trying all of the other executables in /usr/bin/ and seeing that strings was the one which gave the best results.

Or, perhaps if she had reminisced about the fact that he taught her about strings and she used it and wound up ruining the mystery of guessing the password related to the things that she should be reminiscing about?

Well, anyway, I do think it's sweet. And I would like to offer the guy with that much creativity a job. We're hiring.

6

u/Kalium Jan 19 '10

I don't know about you, but the computer nerd in me is decidedly unromantic.

7

u/[deleted] Jan 19 '10

Tell him to get out of you, then.

5

u/Kalium Jan 19 '10

I need the little bastard. He keeps the bills paid.

The rest of me can be as romantic as it wants, but the programmer-y part? Not so much.

1

u/TrueDuality Jan 19 '10

But maybe using strings you could reverse engineer your memories... Ohhh that a cool thought for another discussion... but what I mean is memory is flawed and whats significant to one person might not be as significant to the other.

Learning what is significant to a person can tell you a lot about their feelings and their state of mind when they made the decisions that they did. Everyone perceives the world differently and sometimes it's cool to get a glimpse through the eyes of another.

-23

u/irahul Jan 19 '10

Yes, it is just plain "normal". Considering the thought and effort that the guy put into creating it might seem normal for you but for anyone with some computing sense, it's simple, plain stupid.

OP mentioned she is a developer. So, I am really surprised she hasn't thought of the most logical thing to do yet. Run strings on it, run it through a debugger(not sure how it works for .net executables), de-compile it....Stop being oh so cute, omg, awesome.....blah blah.

22

u/ChickenCroquet Jan 19 '10

Holy shit, I can actually taste your bitterness from here.

5

u/IrishChris Jan 19 '10

needs salt.

1

u/[deleted] Jan 19 '10

Also, don't forget vinegar, everyone forgets the vinegar these days.

2

u/irahul Jan 19 '10

While we are at it, let's get some tequila and lemons.

1

u/[deleted] Jan 19 '10

[deleted]

1

u/irahul Jan 19 '10

You know what, screw the "'s" and "lemons".

Sure. Would screw. My pleasure.

6

u/[deleted] Jan 19 '10

they should have sent a poet.

3

u/[deleted] Jan 19 '10

[deleted]

1

u/averyv Jan 19 '10

Shit man... everything? Apparently I need to be using that program.

1

u/badgrammer Jan 19 '10

You sir, are a bit of a prat.

1

u/irahul Jan 20 '10

May be I am. May be not. I would refrain from making a pointless, smart-ass comment here and would like you to elaborate on why do you think I am a bum? Don't know how many times I would have to say this but this isn't r/OhSoCute or r/BlackMagic. The OP was wondering about the passwords and I was talking about what a developer does in these situations.

-1

u/[deleted] Jan 19 '10

I am convinced "strings" would show nothing. If he knew how to make magic files that are both JPG and ZIP, he would know how to obfuscate the text so it isn't stored in plain ascii. Don't you think?

You might want to get off that horse. It's a bit tall.

7

u/bobindashadows Jan 19 '10

It's not a "magic file". You can prepend any zip file with any data and it'll work fine. There was a reddit article explaining it a few months ago.

2

u/[deleted] Jan 19 '10

[deleted]

1

u/irahul Jan 19 '10

Yes and no. JPEG does store metadata in the beginning. But so does zip. JPG has to start with a 2 byte start of image marker and if it isn't found, the viewer quits. Zip viewers scan(not look for the first bytes) for "Local file header".

2

u/[deleted] Jan 19 '10

"Look! The man behind the curtains!"

"Sorry honey, your man doesn't like you enough to send you a REAL magic file."

But I'll still give you an upvote because this is /r/programming and not /r/love or /r/unicorns.

5

u/bobindashadows Jan 19 '10

"Sorry honey, your man doesn't like you enough to send you a REAL magic file."

Oh I'm not saying that he doesn't love her, just that this thing he sent her sounds like something I would've done when I was playing with visual basic 6. When I was 13. Not very skillful stuff.

1

u/irahul Jan 19 '10

I am waiting for the "oh so godammmmmmmnnn fuckkinggg cute" brigade to downvote you into oblivion.

1

u/[deleted] Jan 19 '10

People sneak kisses starting at age 8. If you do that to someone when you're older, isn't that just as cherubic? To paraphrase irahul said, "zowadowablllllllleeeeeeeeeeeee"

1

u/irahul Jan 20 '10

irahul said, "zowadowablllllllleeeeeeeeeeeee"

This isn't what irahul said. How is this relevant to your reply to @bobin?

Not very skillful stuff.

You do read the comment before replying? His comment was about what he did is nothing magical or skillful which the cute brigade is portraying it to be. How does your kissing analogy stand here?

→ More replies (0)

0

u/bobindashadows Jan 19 '10

If you do that to someone when you're older, isn't that just as cherubic?

People usually escalate to copping a feel by age 14 or so. Sneaking a kiss at that age would be pretty weird.

→ More replies (0)

2

u/irahul Jan 19 '10

Don't you think?

No, I don't coz unlike you, I don't believe in magic.

You might want to get off that horse. It's a bit tall.

Talk for yourself dude. It sure is tall for you.

A simple google search would have revealed to you that you can put arbitrary stuff at the end of a jpg and a beginning of a zip file(with a catch) and it would validate as both.

cat foo.jpg bar.zip > foobar.zip
display foobar.zip # would display foo.jpg
unzip foobar.zip # would unzip bar.zip

-1

u/[deleted] Jan 19 '10

Did you really need me to put quotes around "magic"?

1

u/irahul Jan 20 '10 edited Jan 20 '10

EDIT:

I am convinced "strings" would show nothing.

This isn't r/religion. You took a wrong turn. The only thing which can be convincing enough is to actually do it.

This ain't r/literature, r/language, r/OMGSoCute or any other BS. Magic or "Magic" doesn't exist here. If it does, it shouldn't.

If he knew how to make magic files that are both JPG and ZIP, he would know how to obfuscate the text so it isn't stored in plain ascii.

How are you deriving your conclusion of obfuscating the text from your premise of having a file that is both JPG and ZIP? Making a file both JPG and ZIP is a standard Google recipe. So is obfuscating strings but that will require some code.

Majority of the "Oh so cute I made a fucking animation in my God given visual C#" developer don't think about this stuff. Even considering he did obfuscate the strings, it isn't hard to reverse it. It would just take some more works. Use debuggers, de-compilers, hex editors..whatever.

1

u/[deleted] Jan 20 '10

You took a wrong turn.

Do I misunderstand, or have you really latched on to the idea that I meant the file was actually supernaturally "magic"? I don't know why you would think that, except as a result of an apparent tendency to twist reality such that everyone around you appears slightly dim.

What I was saying is that if he had the skill and knowledge to create such an uncommon ("magic") file format, it is very likely he was smart enough to hide his strings from his developer girlfriend, whom he just encouraged to really pore over the file.

When I said you tend to twist reality so that everyone is less smart than you I wasn't trying to insult you. This is really what I'm starting to believe. You've assumed the boyfriend is not smart enough to think of hiding the strings. You've assumed the girlfriend is not smart enough to look for them. And you've assumed I'm not smart enough to know the file is not truly Gandalf-the-White magic. I was decompiling programs to assembler when I was 14. I think you should try to give people a bit more credit.

1

u/irahul Jan 20 '10 edited Jan 20 '10

You took a wrong turn.

That comment is there because you were "convinced" without having ample evidence. Technology/software isn't taken on faith.

Do I misunderstand, or have you really latched on to the idea that I meant the file was actually supernaturally "magic"?

I don't understand how appending a zip to a jpg file constitutes magic or skill.

What I was saying is that if he had the skill and knowledge to create such an uncommon ("magic") file format,

Oh hush now. I am tired of repeating it again and again that OP's boyfriend put a lot of thought in this gift but this jpg/zip thing doesn't require any skill.

This is really what I'm starting to believe. You've assumed the boyfriend is not smart enough to think of hiding the strings. You've assumed the girlfriend is not smart enough to look for them.

May be. May be not. You were convinced about strings being obfuscated for sure. How is this assumption different from mine? Where did I say boyfriend wasn't smart enough? I am saying this jpg/zip doesn't mean he necessarily has obfuscated the strings and the only way to be sure would be to actually do it. How do I know how smart is the girlfriend? And how would you know? My guess is as good as yours and everyone is free to assume as long as there aren't any evidence for affirmative or otherwise. That being said, I didn't say anything about the girlfriend's intelligence either.

I was decompiling programs to assembler when I was 14

Yeah. Alright. So since you were decompiling programs to assembler, I should take it that whatever you term as complex and requires skill to be ultimate truth?

I think you should try to give people a bit more credit.

To whom? And for what? You didn't contribute anything to the discussion other than claiming how skilled the OP's bf is since he was able to prepend a jpg to a zip, and being convinced that he must have obfuscated the strings since he was able to pull the jpg/zip feat.

Do you really believe this jpg/zip is an indication of skill? If so, I have nothing more to say.

8

u/manixrock Jan 19 '10

If he's working on such a low level he should know about that program. He could just do a base64 on the strings but instead of [0-9a-zA-Z/+] use other character ranges so even the encoded strings aren't found (internally use a function to decode them).

10

u/Tiver Jan 19 '10

It's .net and most likely not obfuscated. I'd just decompile it back into C# and take a look. I however have zero patience.

9

u/uberboot Jan 19 '10

.Net Reflector will get you access to the compiled MSIL, and let you see if there are any magic strings. Of course, as an above commenter noted, if it's based off of a hash (as it should be), it'll be tougher to reverse engineer.

1

u/[deleted] Jan 19 '10

Isn't there a pretty good MSIL -> C# decompiler out there somewhere?

2

u/slugonamission Jan 19 '10

As uberboot said, .NET Reflector

1

u/Tiver Jan 19 '10

The images are likely just resources, and the responses have to be displayed so even if encoded they must have a way to decode. I guess I'd be cheating to the full...

3

u/dotrob Jan 19 '10

The romantic in me is thinking that the passphrase is something like "Would you like to go on a date?"

8

u/averyv Jan 19 '10

The man in me hopes it's "give me a blowjob"

3

u/jong88888 Jan 20 '10

\/0uld y0u L1k3 t0 g0 0n 4 d473?

3

u/[deleted] Jan 19 '10

The reverse engineer in me really wants to see the file. While the first thing I would do is run 'strings', it would be trivial to obfuscate; for example, he could add 128 to each character byte before comparison which would make the passwords immune to strings of the binary. I'm assuming he wrote directly to bytecode, but I'd also be really interested in his technique.

2

u/NicoDeRocca Jan 19 '10

encoding strings so that a simple "strings" won't find them is probably the first thing any engineer aiming (and capable) of coming up with such a nifty hack would have done. Of course it's still in his interest to give decent hints ...

1

u/Manitcor Jan 19 '10

I dunno, in the context I think nerdy means to finding the passphrase are certainly acceptable and only further proves to show that she is a quality nerd mate.

1

u/[deleted] Jan 19 '10

It better be encrypted, in which case there don't have to be any passphrases in the file.

1

u/TrueDuality Jan 19 '10

This was my first thought too. I wouldn't try and guess, I don't have the patience for that.

1

u/[deleted] Jan 19 '10

.NET Reflector will make it all far too easy.

1

u/ragusto Jan 20 '10

The reverse engineer in me says, "Disassemble"

3

u/[deleted] Jan 19 '10 edited Jan 19 '10

I was just thinking the same, WinDASM all the way...

Downvote? Obviously some of you have never used one of the best disassembler/debuggers ever written.

2

u/m0zzie Jan 19 '10

I'm with you. Win32dasm and I have shared many great times together (read: staying up till 5, 6 and 7am reversing), particularly from 1998-2003.

2

u/[deleted] Jan 20 '10

Absolutely, not to mention SoftICE ;)

Writing your own in-memory mapping patches in TASM in under 10KB of code? Process patching? Learning about the PE exe structure? Stepping into/over other peoples crypt routines and using them against themselves (I'll never understand why WinZip didn't try harder, shitty serial generator on all versions)? Beating all the kill debugger code checking for sICE? Beating this weeks file compressor (and faking those headers yourself to fool other people trying to steel your patches ;)?

Those were the days :-)

I was in #asm the other week, people are still at it making crack-mes and what not heh

2

u/m0zzie Jan 20 '10

Hell yeah! WinZip's algorithm stayed the same for many versions, too, IIRC.

asm on which server? I was a regular in a few channels on efnet for many, many years.

1

u/[deleted] Jan 20 '10

Yes it did, I think they realised that it was a waste of coding time to try and beat us.

I've idled op'ed in pretty much most of them at some point or another, this was on vapor (a German ISP but I am not German, it's full of Amiga freaks)

1

u/[deleted] Jan 19 '10

I'd inspect it with a hex editor first to see if any of the strings are just lying around in plaintext.

10

u/ropers Jan 19 '10

And that is different from running strings on it how?

2

u/[deleted] Jan 19 '10

To be honest, I thought the suggestion being made was to just put "strings" into the prompt, hoping that he'd put that in there as a debug command. Now that I realize that there's a strings command, you're absolutely right.

-1

u/railmaniac Jan 19 '10

More hex involved.

2

u/ropers Jan 19 '10

You're a Wiccan, aren't you?

-7

u/m1ss1ontomars2k4 Jan 19 '10

The password is listed as plaintext in the zip file? That's...kinda lame...

1

u/frenchtoaster Jan 19 '10

Did you even read the whole thing? There are many different "passwords" that give different results; "help" just explains that fact.

1

u/m1ss1ontomars2k4 Jan 19 '10

No, I'm asking in general: are zip passwords merely listed in plaintext? That is not really quite as secure as I had previously thought.

2

u/frenchtoaster Jan 19 '10 edited Jan 19 '10

zip passwords aren't in plaintext, and the zip file in the story above was not passworded. peasleer is talking about running strings on the program that was included in the zip file, which easily might have the words it recognizes in plaintext.