DamCTF 2020 - Malware Phase 2 Solution Script

phase2.py

from Crypto.Cipher import ARC4
import sys

# read in malware
with open(sys.argv[1], "rb") as f:
    data = f.read()

# get data
config_block = data[0x51a0:0x5394]
key_len = 32
config_key = data[0x4010:0x4010+key_len]

chunk_len = 50

# chunk[0] & 0x4, encrypted
# chunk[0] & 0x8, decrypted

def fun_00101a19(key, chunk):
    cipher = ARC4.new(key)
    indata_00 = list(chunk[1:])

    indata = b"\x00" * 0x31

    indata = list(cipher.decrypt(indata))

    for i in range(48, -1, -1):
        iVar2 = (indata[i] + i) % 49
        uVar1 = indata_00[i]
        indata_00[i] = indata_00[iVar2]
        indata_00[iVar2] = uVar1

    return cipher.decrypt(bytes(indata_00))

for i in range(len(config_block)//chunk_len):
    plaintext = fun_00101a19(config_key, config_block[i*chunk_len:(i+1)*chunk_len])
    key = plaintext[:4].decode()
    val = plaintext[4:].decode().split("\x00")[0]
    print(f"{key} = {val}")