Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
#!/usr/bin/python
import sys
import struct
import binascii
f = open("result.bin")
data = bytearray(f.read())
f.close()
lastChunkSize = 0xFFFFFFFF
# rules = []
flag = bytearray("\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")
f3 = open("rules.lst","w")
oldkey = flag[0x1D]
newkey = oldkey & 2
flag[0x1D] = chr(newkey)
def seekKey(location):
for i in range(0,100):
if data[location+i:location+i+2] == bytearray("\x8A\x40") and data[location+i+3] == 0x24 and data[location+i+5] == 0x74:
if data[location+i+5] == 0x74:
char_array = data[location+i+2]
char_value = data[location+i+4]
oldkey = flag[char_array]
if oldkey & char_value == 0:
newkey = oldkey + char_value
else:
newkey = oldkey
flag[char_array] = chr(newkey)
f3.write("flag[0x%x] & 0x%x != 0\n" % (char_array,char_value))
elif data[location+i+5] == 0x75:
f3.write("flag[0x%x] & 0x%x == 0\n" % (char_array,char_value))
else:
print "DAFUQ?"
sys.exit(0)
return
def decryptChunk(location):
if location == 0:
return False
nextChunkSize = struct.unpack("I",data[location:location+4])[0]
nextXorKey = struct.unpack("I",data[location+4:location+8])[0]
print "next chunk is 0x%08x, key 0x%08x, decrypting..." % (nextChunkSize,nextXorKey)
# x = raw_input().rstrip()
# if x == 'y':
if nextChunkSize < lastChunkSize:
for i in range(2,nextChunkSize):
nextDataBlock = struct.unpack("I",data[location + (i*4):location + ((i +1) * 4)])[0]
nextData = nextDataBlock ^ nextXorKey
nextDataWrite = struct.pack("I",nextData)
data[location + (i*4):location + ((i +1) * 4)] = nextDataWrite
seekKey(location + 4)
return True
else:
return False
#else:
# return 0
def seekNext(offset):
for i in range(offset + 1,len(data)):
# print data[i:i+12]
if data[i:i+12] == bytearray("\xB8\x3C\x00\x00\x00\xBF\x01\x00\x00\x00\x0F\x05"):
# print "found, offset %d" % (i+12)
return i + 12
return 0
offset = 0x49
r = True
while r:
r = decryptChunk(offset)
offset = seekNext(offset)
print "done, writing to file..."
f2 = open("out.bin","wb")
f2.write(data)
f2.close()
f3.close()
print flag
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.