Passwords of 4 Characters or Less:

By comparing the encoded password blocks of various short passwords (example in Figure 3), it was determined that a 32-byte constant (Figure 4) was simply being XORed against the ASCII password block.

$A$ = ASCII password
$B$ = 32-byte constant block
$C$ = encoded password block

The starting index, $j$, into the constant block where the XOR operation should begin is calculated by:

j = (A[0] + strlen(A)) % 32;

The encoded password block is then created:

for (i = 0; i < 32; ++i, ++j)
{
   // wrap around to beginning
   if (j == 32) j = 0;

   C[i] = A[i] XOR B[j];
}

Figure 3: Encoded password block of ASCII password `test'

Figure 4: 32-byte constant block for use with passwords of length 4 characters or less