alt Hacker Newscrypt is defined in assembly at s3 crypt.s and it would appear to use the same family of "cryptographic machine" as V6's crypt.c but it is even shorter and I can't tell if it has bounds checks or not — V6 limits output size to 512.
edit: if hash output length is variable it may be impossible to find a solution and then a side channel timing attack is probably the best option.
someone liked this but note that someone else had already determined it is limited to 64 bytes on a previous HN post so the overflow hack does work.