Keyspace List for WPA on Default Routers

[drsnooker]

One thing that struck me was the prevalence of the 'b' character versus 'a' which made me wonder if zeroes are for whatever reason much less likely to be generated from whatever the 'seed' is (my assumption being that 'a' equates to '0' and 'b' equates to '1').  I had done a statistical analysis on the data, and 'b' was indeed among the most common characters.

Yeah the 640L algo would produce the same amount of 'a' vs 'b' but almost twice 'abcdef' vs 'ghij' so I blamed it on the small sampling size, but it could be a completely a different algo that treats 0 differently. There's definitely something fishy going on. If you overlay the letters and numbers they show a similar tendency for 1/b and slightly lower for 2/c.
The other chars could even be about the same likelihood. Won't know how any of this works until we find the algo in a random firmware somewhere.