Skip to content

Instantly share code, notes, and snippets.

@Andoryuuta
Created October 29, 2019 12:17
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save Andoryuuta/51f615d35d7d57b4741ea7aaa7f1d9cb to your computer and use it in GitHub Desktop.
Save Andoryuuta/51f615d35d7d57b4741ea7aaa7f1d9cb to your computer and use it in GitHub Desktop.
from Crypto.Cipher import AES # py -3 -m pip install pycryptodome
from hexdump import hexdump
import binascii
def decrypt(data, unk_arg_1, unk_arg_2):
output = bytearray(data[:])
mutated_key = bytearray(binascii.unhexlify('34313732343344414436354433344643'))
for i in range(unk_arg_1):
p1_i = 15
p1_got_null = True
while p1_i > 0 and p1_got_null:
v14 = mutated_key[p1_i] + 1
mutated_key[p1_i] = v14 & 0xFF
p1_got_null = v14 == 0
p1_i -= 1
cipher = AES.new('2770d56e1b77437e8a1e3904b5d73cfb', AES.MODE_ECB)
v12 = unk_arg_2
i2 = 0
i1 = 0
while i2 < len(data):
xor_key = cipher.decrypt(mutated_key[:])
i2 = 16 * i1
if 16* i1 > unk_arg_2:
i2 -= unk_arg_2
while v12 < 16 and i2 < len(data):
output[i2] ^= xor_key[v12]
i2 += 1
v12 += 1
v12 = 0
p2_i = 15
p2_got_null = True
while p2_i > 0 and p2_got_null:
v15 = mutated_key[p2_i] + 1
mutated_key[p2_i] = v15 & 0xFF
p2_got_null = v15 == 0
p2_i -= 1
i1 += 1
hexdump(output[:16])
data = binascii.unhexlify('B8 50 D3 57 4F 50 86 EE D3 A2 F4 A9 C3 A7 9F 73 F4 8A 5B 75 B6 74 46 0B DD B8 C4 86 6E 07 E8 E6 C6 6B BA FE'.replace(' ', ''))
decrypt(data, 0, 0)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment