r86bf.py

#!/usr/bin/env python3

import sys
import random

RULE = [0,1,1,0,1,0,1,0]

def next(x):
  x = (x & 1) << 257 | x << 1 | x >> 255
  y = 0
  for i in range(256):
    y |= RULE[(x >> i) & 7] << i
  return y

# bootstrap the PRNG
# total 29 chars from hint image
password = 'INS{vbv"zU123AFn\cBx_%?45678}'

while 1:
  #r=random.randint(1,28)
  for r in range(5,28):
    maxfound=0
    foundchars=""

    for c1 in range(32,127):
      for c2 in range(32,127):
        temppassword=password[:r-1]+chr(c1)+chr(c2)+password[r+1:]
        keystream = int.from_bytes(temppassword.encode(),'little')
        for i in range(128):
          keystream = next(keystream)
        goal=0x52cc2cc124e3f2c28f5b9123904dc015babfd5c0988cb8d670f190fbb57593e2
        numok=0
        for i in range(256):
          if((keystream&(1<<i))==(goal&(1<<i))):
            numok+=1
        if(numok>maxfound):
          maxfound=numok
          foundchars=""
        if(numok==maxfound):
          foundchars+=chr(c1)+chr(c2)
    print('maxfound: '+str(maxfound)+', pos: '+str(r)+', foundchars: >'+foundchars+'<')
    r2=random.randint(1,len(foundchars)//2)-1
    betterchar1=foundchars[r2*2]
    betterchar2=foundchars[r2*2+1]
    password=password[:r-1]+betterchar1+betterchar2+password[r+1:]
    if(maxfound==256):
      print('Solution: '+password)
    else:
      print('better: '+password)