leo-stone's hack-petya beat Petya ransomware by finding the key instead of paying

During an Easter visit to his father-in-law, leo-stone found a household in trouble with Petya ransomware. Someone was applying for a job and the host really needed to read his CV, so he entered the admin password — and instead of the files he got Petya's red skull, the sign that the disk's master file table had been encrypted. The offered way out was to pay for a key. The author framed the alternative plainly: "paying ransom isn't that much of a challenge"; the challenge was breaking the lock without paying.

Rather than attack the cipher head-on, leo-stone targeted the way Petya itself checks a typed key. He reimplemented the verification hash and published the essentials: Salsa on 16-bit words instead of 32, running ten rounds (Salsa10), not twenty (Salsa20). The test data stays on the victim's disk — an 8-byte nonce at sector 54 and a 512-byte encrypted verification sector at sector 55. His Go program reads those 512 bytes, XORs the interesting words with 0x37 to recover the hash's target output, reads the nonce, and fires a genetic solver at the problem.

The solver found the key in seconds — 10 to 30 in his own case — and he released it as the open-source hack-petya repository with simple instructions: pull the nonce and verification sector off the encrypted disk, save them as nonce.txt and src.txt, run the program, wait, then use the key, ideally on a disk image in a VM. He apologized for the messy code ("I was kinda in a hurry") and patched the genetic library after it panicked on concurrent map reads under Go 1.6. The launch drew 451 points and 79 comments on Hacker News on April 11, 2016; the repository shows 612 stars and 80 forks.

Reimplement Petya's key check, then let a genetic solver find the key — no ransom paid

He attacked the key check instead of the cipher: the verification sector sits on the victim's own disk, turning Petya's design into a testable oracle anyone could rebuild

A genetic solver made the search fast: candidate keys evolved against the reimplemented hash until the right one emerged, in 10-30 seconds instead of a brute-force wait

The fix shipped free with exact recovery steps, so other victims could decrypt without paying and without sending their disks anywhere

Publishing on GitHub and Hacker News gave the tool reach: 451 points and 79 comments at launch, and a repository that still shows 612 stars and 80 forks

A lock that must verify its own key leaves an oracle on the victim's side: rebuild the check and search against it instead of paying, then give the tool away so the fix spreads.

leo-stone recovered his own key in 10-30 seconds and released the tool openly. The Hacker News launch on April 11, 2016 drew 451 points and 79 comments, and the repository as archived shows 612 stars, 80 forks and 34 watchers. The page records no claim about later Petya variants; what it leaves behind is the reusable pattern — extract the on-disk verification data, rebuild the check, and let a search find the key.