kizbox exploit

[samuel-azerty]

Hello,
I have tried to exploit the kizbox key generation to retrieve the private key however it is unsucessfull. If someone can help me, it would be great.

Step 1 : Generation all possible keys with luajit 2.0 on my computer with this script
generate.lua.txt
(in the file generated only july 2019, but I did it on all 2019)

https://github.com/Per-Terra/LuaJIT-Auto-Builds/releases/download/build-2026-08-06-01-46-15/LuaJIT_2.0_Win_x64.zip

Step 2 : sniff some packets with io-rts-esp32 and a heltec lora v2
io-hctrl: (323696) Rcvd (868.95) command 00 from 1628EE to 94F719 CTRL0 4E CTRL1 00 - 6 bytes: 08E7C8000000
io-hctrl: (323714) Rcvd (868.95) command 3C from 94F719 to 1628EE CTRL0 0E CTRL1 00 - 6 bytes: 7D60043F58B2
io-hctrl: (323717) Rcvd (868.95) command 3D from 1628EE to 94F719 CTRL0 0E CTRL1 00 - 6 bytes: B6C857AD0E65

Step 2 bis : generate IV from the sniffing
Command ID : 00 08E7C8000000
challenge : 7D60043F58B2
Deduced IV => 0008e7c8000000555b737d60043f58b2

Step 3 :
Try the encrypted the deduced IV with all aes key generated before.
reduced_script.txt
I use aes.py and Iown-ioCrypto.py exept for create_2W_hmac that I have lightly rewritten.

Step 4 :
Compare if one result match with B6C857AD0E65.
None matched.