DEV Community

I wrote a 10,000-line Windows security suite in one Python file. Here's how the crypto container works, and ₹50 if you can break it

Akhouri Anmol Kumar on October 21, 2026

Most small encryption tools fail in boring places, not in the cipher. They fail on what happens with a wrong password, a doctored header, a rolled-...

Read full post

EffessDev • Oct 21

Bro can you give a Linux build? I only have an Ubuntu VM no Windows 😢

Akhouri Anmol Kumar • Oct 21

bro just go to windows feature on or off and on your windows sandbox feature, restart your PC and go to search and search sandbox and click it and here you go.

EffessDev • Oct 21

Windows Home 😊

Akhouri Anmol Kumar • Oct 21

bro then I don't know solution.

EffessDev • Oct 21

😭 my 50INR

Akhouri Anmol Kumar • Oct 21

☠️bro how you have so much confidence that you can break ATLOCK_v5 easily.
reminder: It's Akhouri Systems flagship product
and till now even mustafa Erbay has not confirmed whether he has braked it or not.

Akhouri Anmol Kumar • Oct 21

@xulingfeng bro just asking I don't know you know or not but I recently heard that China is trying to replicate ASML's lithography machine I guess which is only made by ASML in worldwide creating a monopoly and now China is trying to interrupt that monopoly.... bro please make xi jingping India's PM ☠️👑

xulingfeng • Oct 21

Bro, that's quite a topic jump 😂 How did we go from finding bugs in your software to lithography machines? Focus, will you? ☠️

Akhouri Anmol Kumar • Oct 21

no just interested. because other than technology I love geopolitics too and if china is really trying to replicate ASML lithography machine then they are really gonna interrupt the monopoly of west.

xulingfeng • Oct 21

You should look into it. China has already broken monopolies in quite a few other industries, not just lithography. The funny thing is, many of those products used to sell at ridiculously high prices. Once real competition showed up, prices started dropping. Funny how that works, huh? Monopolies are great — if you're the one making all the money. 😂

Akhouri Anmol Kumar • Oct 21

yeah and west is the one making money for now but seeing China's reverse engineering skills I am sure in next 2-3years China is gonna announce that they have now lithography machines too.
also even if China ignores to build lithography which they will not but still if we suppose still China has monopoly in rare earth metals required to build those machine parts.

xulingfeng • Oct 21

Let's leave geopolitics aside. I'm afraid the more we talk about it, the prouder I'll get of my country. Hahaha. 😂

Akhouri Anmol Kumar • Oct 21

@merbayerp hehehehe

Mustafa ERBAY • Oct 21

Hahaha, Anmol! 😂🔥 Bro, why are you putting my name on the battlefield already? ☠️

I haven’t confirmed a break because I don’t want to call something a vulnerability without reproducible evidence.

And honestly, I’m not here for your ₹50. Keep that money, my friend! 😂❤️

What interests me is the engineering behind ATLOCK. You’ve clearly put serious thought into key derivation, authenticated encryption, state integrity, and rollback protection.

But you know how security works: a strong design on paper and a secure implementation are two different things. 😉

If I find something meaningful, you’ll get a proper technical report with reproduction steps, impact, and suggested fixes.

Until then, don’t celebrate too early, bro! 😂🔐🔥

Mustafa ERBAY • Oct 21 • Edited

Hey Anmol! 😄🔐

Well, brother, you mentioned my name in the challenge, so I figured I owed you more than a quick look. 😂🔥

First, congratulations on the work you’ve put into ATLOCK v5. There’s a lot of thoughtful engineering here, and I genuinely appreciate your willingness to invite independent scrutiny.

After more than two decades working with enterprise infrastructure, systems architecture, and security, I’ve learned something important: cryptographic strength and implementation security are two very different things.

So I decided to take your challenge seriously.

I went beyond the documentation and performed a static analysis of the extracted ATLOCK v5 binary, examining the container format, padding implementation, and selected CLI execution paths.

And I found something interesting. 👀

🔴 Finding 1: Padme Size-Hiding Information Disclosure

Status: Supported by static data-flow analysis; Windows runtime confirmation pending.

Your v3.1 container includes an eight-byte plain_len field at header offsets 74–81.

The _v3_header implementation serializes this value as a big-endian unsigned 64-bit integer.

However, the original plaintext length appears to remain directly readable from the unencrypted header, even when Padme padding is enabled.

The padding changes the resulting container size, but not the original length stored in the header.

This means an observer who possesses an encrypted container may be able to recover its exact original plaintext length without knowing the password.

The issue doesn’t compromise AES-256-GCM or expose the plaintext itself. However, it undermines the specific confidentiality property that size-hiding padding is intended to provide.

The reproduction check is straightforward:

import struct
with open("encrypted-file", "rb") as f:
    f.seek(74)
    original_size = struct.unpack(">Q", f.read(8))[0]
print(original_size)

A dynamically generated padded v3.1 container is still needed to confirm the behavior end to end.

🟠 Finding 2: Potential CLI Lockout Enforcement Gap

Status: Static observation; bypass not demonstrated.

I also examined the CLI execution paths associated with --open and --verify.

The reviewed branches appear to invoke container operations without passing through the application’s normal lockout checks.

This raises an architectural question:

Is lockout enforcement guaranteed across every entry point, or is it primarily enforced by the interactive application layer?

To be clear, I have NOT demonstrated a successful lockout bypass, password-free decryption, or PIN-mode compromise.

Additional call-chain analysis and Windows runtime testing are required before treating this as a confirmed vulnerability.

A few thoughts from one engineer to another

Anmol, I respect the ambition behind this project.

But here’s something I consider fundamental in security engineering:

A security feature is only as strong as the property it actually enforces, not the property its design intends to enforce.

Padding should protect length confidentiality.

Lockout mechanisms should have clearly defined enforcement boundaries.

Authentication should remain consistent across supported interfaces.

And every security claim should be independently testable.

That’s why I prefer reproducible evidence over dramatic claims about breaking encryption.

I haven’t broken your cryptography, and I won’t pretend otherwise.

What I have identified is a statically supported information-disclosure issue and a separate enforcement question that deserves further investigation.

I’m happy to share the relevant technical details privately and help validate potential fixes.

And about your ₹50 reward… 😂❤️

Keep it, my friend. Invest it in ATLOCK v6.

I’m not interested in winning money from a young developer. I’m interested in seeing promising engineering become stronger through constructive security research.

You’ve already demonstrated something valuable: the willingness to put your work in front of people who will question it.

That’s how we all improve.

Respect from Türkiye! 🇹🇷🤝🇮🇳

Keep building, keep learning, and never stop challenging your own assumptions.

Security isn’t about proving that nobody can break your software. It’s about discovering where your assumptions fail before someone else exploits them.

Looking forward to seeing how ATLOCK v6 evolves, brother! 🔐🔥

Akhouri Anmol Kumar • Oct 21

Mustafa ERBAY BROOOOO!, u are 100% correct on both counts the Padme header leak and CLI lockout bypass are valid architectural flawsss, and i truly appreciate(🔥) you pointing them out constructively. these are going straight into the v6 fix list.
Respect from India! 🇮🇳🤝🇹🇷 (India-turkey bhai bhai maybe just because of pakistan our freindship is little bit tensed like country wise otherwise geopolitics aside you are my brooooo experienced broo.)
by the if you had even accept 50rupees still i can't give you because it's for indians or for those who have UPI and you are from turkey you will not have UPI that's why 😂

Mustafa ERBAY • Oct 21

BROOOOO! 😂❤️🔥

Now THAT is the response I love seeing from a developer!

You didn’t get defensive, you didn’t make excuses, and you immediately added the findings to your v6 roadmap. That attitude is worth far more than ₹50, my brother. 😄

One small technical note, though: let’s still validate the CLI lockout behavior dynamically before calling it an exploitable bypass. Good security engineering means being just as careful when confirming vulnerabilities as when discovering them.

As for geopolitics, my friend, let’s leave that to the politicians. 😂

I’m from Türkiye, you’re from India, and we’re two people who genuinely enjoy technology, engineering, and learning from each other.

That’s more than enough for a friendship. 🇹🇷🤝🇮🇳

And about the UPI problem… don’t worry, bro. My bug reports come with free international shipping! 😂📦🔐

Keep building, Anmol. I’ll be genuinely happy to see ATLOCK v6 become stronger.

And remember, little brother: the best engineers aren’t the ones who never make mistakes. They’re the ones who turn every discovered weakness into a better design.

Much respect, brother! ❤️🔥

Akhouri Anmol Kumar • Oct 21

yup bro, ATLOCK v6 will follow your notes about the "the best engineers aren’t the ones who never make mistakes. They’re the ones who turn every discovered weakness into a better design"
I don't have any exact date I can give you that when I'm gonna start building v6 because I feel like now before reaching 3k downloads I should not start building that grand level project also till 3000 I'm not sitting and doing time pass before v6 my plan is to make my web app good APIC Web... I've said you to try it but you didn't replied never mind.