Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
with open('Protected.exe', 'rb') as f:
data = f.read()
data = [ord(x) for x in data]
data = data[0x7B8:]
regs = {1 : 'eax', 2: 'ebx', 3: 'ecx', 4: 'edx', 5: 'esi', 6: 'edi', 7:'esp', 8:'eip', 9:'ebp'}
baseAddr = 0
f = open('asm', 'w')
while baseAddr < len(data):
buffer = data[baseAddr:baseAddr+5]
if buffer[0] == 0:
f.write('mov ' + regs[buffer[1]] + ', ' + regs[buffer[2]] + '\n')
baseAddr += 3
elif buffer[0] == 1:
f.write('mov ' + regs[buffer[1]] + ', ' + hex(buffer[2]) + '\n')
baseAddr += 3
elif buffer[0] == 2:
f.write('xor ' + regs[buffer[1]] + ', ' + regs[buffer[2]] + '\n')
baseAddr += 3
elif buffer[0] == 3:
f.write('sub ' + regs[buffer[1]] + ', ' + regs[buffer[2]] + '\n')
baseAddr += 3
elif buffer[0] == 4:
f.write('add ' + regs[buffer[1]] + ', ' + regs[buffer[2]] + '\n')
baseAddr += 3
elif buffer[0] == 5:
f.write('push ' + regs[buffer[1]] + '\n')
baseAddr += 2
elif buffer[0] == 6:
f.write('pop ' + regs[buffer[1]] + '\n')
baseAddr += 2
elif buffer[0] == 7:
f.write('add ' + regs[buffer[2]] + ', ' + regs[buffer[3]] + '\n')
f.write('mov ' + regs[buffer[1]] + ', BYTE [' + regs[buffer[2]] + ']\n')
baseAddr += 4
elif buffer[0] == 8:
baseAddr += 2
elif buffer[0] == 9:
baseAddr += 2
elif buffer[0] == 10:
f.write('cmp ' + regs[buffer[1]] + ', ' + regs[buffer[2]] + '\n')
baseAddr += 3
elif buffer[0] == 11:
f.write('and ' + regs[buffer[1]] + ', ' + regs[buffer[2]] + '\n')
baseAddr += 3
elif buffer[0] == 12:
f.write('shl ' + regs[buffer[1]] + ', ' + regs[buffer[2]] + '\n')
baseAddr += 3
elif buffer[0] == 13:
f.write('shr ' + regs[buffer[1]] + ', ' + regs[buffer[2]] + '\n')
baseAddr += 3
elif buffer[0] == 14:
f.write('add eip, 1\n')
f.write('push eip\n')
baseAddr += 2
elif buffer[0] == 15:
f.write('mov eip, ' + regs[buffer[1]] + '\n')
elif buffer[0] == 16:
f.write('add ' + regs[buffer[2]] + ', ' + regs[buffer[3]] + '\n')
f.write('mov ' + regs[buffer[1]] + ', DWORD [' + regs[buffer[2]] +']\n')
baseAddr += 4
elif buffer[0] == 17:
f.write('jnz failed \n')
baseAddr += 2
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment