> By an astonishing coincidence, the number of bits in the input format is approximately the log2 of the number of MD5 evaluations that a five-year-old GPU can do in an hour.
I read this to mean he calculated a matching hash on his GPU, in order to tune the magic constants of his app to produce the desired output.
> There are no magic numbers in the program
There are several:
long z,x,G;main(){for(puts("P1\n80 80"),scanf("%10lx",&G);3-z/2160;x=++z%81/8-5)putchar(5>x?!(16>>(x^-(x<1))+1&G<<5>>z/648*5)^49:10);}
Most of those numbers aren't possible to change, 80x80 is the output size, %10 is the input size.
Changing any of the other numbers would surely impact the function of the program, I don't think you could get to a 40 bit brute-force there.
I think the brute-force was done by making non-semantic changes like variable names and changing the order of the declarations.
> I think the brute-force was done by making non-semantic changes like variable names and changing the order of the declarations.
Yep. You have 17 bits of entropy just in the names of three single-letter variables.