Some success.
These are the first entries of the plain conversion table as it comes from the vm memory:
Code:
<---- ????? ----> <---- A ----> <---- A' ---->
b6 be 74 2b 32 c7 94 d0 bc cc b2 72 76 b8 af 89
73 84 14 69 fc ee 88 0a 8a ae 33 41 f8 50 02 ad
ac 84 f4 00 e2 47 38 0e 56 3e a1 49 0b 82 39 21
a2 84 04 1e 5c 35 de f6 6a e1 0f bc 92 5d 3a cd
I have calculated the corresponding B and B' for the first segment:
Code:
B = 3EFDFC42F8
B' = 3F99F3C46C
You can verify that:
Code:
0x94d0bcccb2 XOR B = 0xAA2D408E4A
0x7276b8af89 XOR B' = 0x4DEF4B6BE5
0x880a8aae33 XOR B = 0xB6F776ECCB
0x41f85002ad XOR B' = 0x7E61A3C6C1
...
Each of the 5 bytes overwrite a "bad spot" as you can see from posting
#13.