findFile.py

"""
A horrible script, however gets things done ;)

USE CASE : If file encrypted with simple xor

Enter expected key, can be file format's hex
It will automatically find the key based on that header
And write out a new file out of it
"""

fileTypes = {
    "JPEG-Standard":("FF D8 FF E0","jpeg"),
    "JPEG-Standard-With-EXIF":("FF D8 FF E1","jpeg"),
    "Canon Camera Image File Format":("FF D8 FF E2","jpeg"),
    "Still Picture Interchange Format":("FF D8 FF E8","jpeg"),
    "PNG":("89 50 4E 47 0D 0A 1A 0A","png"),
    "TIFF":("49 20 49","tiff"),
    "GZIP":("1F 8B 08","gz"),
    "ZIP":("50 4B 03 04","zip"),
    "BZIP2":("42 5A 68","bz2"),
    "7-ZIP":("37 7A BC AF 27 1C","7z"),
    "MP3":("49 44 33", "mp3"),
}

def xor(a, b):
    return a^b

def repeated_xor(key, ct):
    pt = bytearray()
    for i in range(len(ct)):
        pt += chr(xor(ct[i],key[i%len(key)]))
    return pt

def convertToByteArray(fileSignature):
    key = bytearray()
    fileSignature = fileSignature.split(" ")
    for hexa in fileSignature:
        key += chr(int(hexa,16))
    return key

def findKey(expectedData, ct):
    key = bytearray()
    expectedData = convertToByteArray(expectedData)
    for i in range(len(expectedData)):
        key += chr(xor(expectedData[i], ct[i]))
    return key


def main():
    fileSignature = raw_input("Enter signature ( as FF DD , i.e. separated with single space) or enter -1 to go with default options : \n")
    if fileSignature != "-1":
        fileSignature = convertToByteArray(fileSignature)
    else:
        print("You've chosen the default fileTypes")
    filePath = raw_input("Enter file path : \n")
    with open(filePath) as f:
        ct = f.read()
        ct = bytearray(ct)
    for k,v in fileTypes.iteritems():
        print("Converting to "+k)
        key = findKey(v[0], ct)
        data = repeated_xor(key, ct)
        fileName = filePath + "." + v[1]
        with open(fileName, 'w') as f:
            f.write(data)
    print("All done")


main()