PeterG75

#!/usr/local/bin/env python

########################################################################################################
##
## Decrypts the AdWind configiration files! 
##  ** May also work for other files **
##
##
## All credit to Michael Helwig for the original Java implementation:
## https://github.com/mhelwig/adwind-decryptor

PeterG75

/*
 * SharpPick aka InexorablePoSH
 * Description: Application to load and run powershell code via the .NET assemblies
 * License: 3-Clause BSD License. See Veil PowerTools Project
 * 
 * This application is part of Veil PowerTools, a collection of offensive PowerShell 
 * capabilities. Hope they help! 
 * 
 * This is part of a sub-repo of PowerPick, a toolkit used to run PowerShell code without the use of Powershell.exe 
 */

PeterG75

using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Text;

public class TestClass
{
	
	public TestClass()
	{}

PeterG75

import idautils 
import idaapi
import idc


def string_decrypt(data_ea, data_len):
    data = idc.GetManyBytes(data_ea, data_len)
    key = '89798798798g79er$'
    out = 'str_'
    for i in range(0 , len(data)):