vba_decode.py

#%%
key = open("/Users/blueset/Downloads/key.txt", "r").read()
idx = key.find("3jX8lFiNQ7JHQBVuXAEQXIajamj1EDqa9n34eHZ7y0XbfuxPt7pMj")
key = key[idx - 143:]
# key = key[idx - 200:]

#%%
def vba_decode(sequence, offset, key):
    # Input a list and an integer
    # key = "XAEQXIajamj1EDqa9n34eHZ7y0XbfuxPt7pMj3jX8lFiNQ7JHQBVu"
    result = ""
    for i in range(1, len(sequence) + 1):
        i_mod = i % len(key)
        if i_mod == 0:
            i_mod = len(key)
        step1 = key[i_mod+offset-1]
        step2 = ord(step1)
        step3 = step2 ^ sequence[i - 1]
        result += chr(step3)
    return result

seq = [123, 11, 48, 89, 76, 63, 6, 59, 118, 65, 47, 104, 51, 39, 51, 27, 120, 41, 36, 50, 51, 44, 5, 75, 65, 36, 77, 92, 101, 55, 5, 4, 88, 2, 90, 90, 2, 104, 59, 91, 21, 16, 33, 13, 19, 7, 88, 54, 29, 91, 21, 62, 75]
offset = 143
result = "Haha you've been hacked! I'm stealing all your files!"
Part1 = vba_decode(seq, offset, key)
assert Part1 == "Haha you've been hacked! I'm stealing all your files!"

#%%
def vba_reverse(sequence, offset, result):
    # Input a list and an integer
    key = {}
    for i in range(1, len(sequence) + 1):
        i_mod = i
        step3 = ord(result[i - 1])
        step2 = step3 ^ sequence[i - 1]
        step1 = chr(step2)
        key[i_mod + offset - 1] = step1
    return key

rev = vba_reverse(seq, offset, result)
# %%
print(vba_decode([35, 33, 60, 17, 9, 127, 109, 17, 78, 82, 109, 64, 28, 110, 13, 105, 98, 116], 125))
print(vba_decode([47, 39, 58, 70, 14, 80, 16, 27, 20, 75, 73, 78, 101, 14, 85, 49, 30, 15, 90, 17, 26,
102, 30, 33, 22, 1, 38, 63, 70, 52, 1, 41, 2, 42, 88, 9, 92, 69, 20, 23, 15,
56, 28, 60, 58, 79, 93, 81, 118, 28, 2, 20, 118, 95, 57, 18, 87, 19, 26, 57, 110,
53, 7, 5, 0, 52, 45, 31, 3, 70, 11, 99, 40, 28, 59, 119, 13, 108, 110, 4, 66,
40, 6, 76, 94, 98, 56, 76, 25, 64, 80, 69, 63, 71, 60], 30))
print(vba_decode([26, 89, 24, 113, 51, 48, 52, 28, 14, 48, 9, 46, 53, 12, 4, 5, 8, 67, 54, 54, 27, 29, 123, 77, 28, 88], 4))
print(vba_decode([33, 23, 68, 54], 0))

# %%
for i in range(len(key)):
    result = vba_decode([47, 39, 58, 70, 14, 80, 16, 27, 20, 75, 73, 78, 101, 14, 85, 49, 30, 15, 90, 17, 26,
102, 30, 33, 22, 1, 38, 63, 70, 52, 1, 41, 2, 42, 88, 9, 92, 69, 20, 23, 15,
56, 28, 60, 58, 79, 93, 81, 118, 28, 2, 20, 118, 95, 57, 18, 87, 19, 26, 57, 110,
53, 7, 5, 0, 52, 45, 31, 3, 70, 11, 99, 40, 28, 59, 119, 13, 108, 110, 4, 66,
40, 6, 76, 94, 98, 56, 76, 25, 64, 80, 69, 63, 71, 60], 30, key[i:])
    if "dvCTF{" in result:
        print(result)

# %%
key = open("/Users/blueset/Downloads/key2.txt", "r").read()
# for i in range(len(key)):
#     result = vba_decode([41, 51, 25, 44, 5, 73, 26, 62, 46, 17, 86, 87, 23, 51, 61, 16, 10, 37, 29, 26, 15, 69, 19, 92, 4, 56, 61, 21, 2, 45, 1, 33, 61, 32, 43, 59, 16, 49, 6, 82, 38, 66, 5, 13, 29, 47, 47, 19, 2, 16, 16], 0, key[i:])
#     if "dvCTF{" in result:
#         print(result)
# for i in range(len(key)):
#     if "dvCTF{" in result:
#         print(result, i)
# for i in range(len(key)):
    # if "dvCTF{" in result:
    #     print(result, i)

result = vba_decode([49, 47, 20, 28, 19, 79, 56, 91, 61, 85, 3, 8, 106, 120, 33, 54, 17, 37, 124, 48, 102, 47, 97, 109, 42, 90, 28, 69, 6, 120, 45, 10, 7, 12], 0, key[149874:])
print(result)
result = vba_decode([1, 53, 32, 16, 99, 43, 34, 66, 66, 38, 61, 75, 53, 4, 80, 11, 75, 49, 50, 22, 59, 36, 50, 88, 16, 62, 87, 15, 72, 42, 27, 34, 19, 26, 33, 61, 19, 77, 48, 46, 58, 102, 8, 94, 64, 36, 72, 47, 32, 56, 80, 0, 106], 34, key[149874:])
print(result)
# %%