Skip to content

Instantly share code, notes, and snippets.

@eybisi
Created June 22, 2018 14:32
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save eybisi/5f4d3d9f832003a06ea9a82353626ec0 to your computer and use it in GitHub Desktop.
Save eybisi/5f4d3d9f832003a06ea9a82353626ec0 to your computer and use it in GitHub Desktop.
def socksl(strinput):
length = len(strinput)
arr = [0 for i in range(length)]
i = length - 1
while i >= 0:
char1 = strinput[i]
n = i - 1
arr[i] = chr(ord(char1) ^ 0x5c)
if n < 0:
break
i = n - 1
arr[n] = chr(ord(strinput[n]) ^ 0x1e)
return ''.join(arr)
def get_string(addr):
out = ""
while True:
if Byte(addr) != 0:
out += chr(Byte(addr))
else:
break
addr += 1
return out
def handle_function(func_start):
for h in idautils.FuncItems(func_start):
for xref in XrefsTo(h, 0):
#print 'from', hex(xref.frm), 'to', hex(xref.to),
inst = DecodePreviousInstruction(xref.frm)
if(get_operand_type(inst.ea,1) != 9):
continue
st = get_string(get_name_ea(inst.ea,print_operand(inst.ea,1)))
dec = socksl(st)
print get_operand_type(inst.ea,1),c,st,"-->",dec
set_cmt(xref.frm,dec,1)
@eybisi
Copy link
Author

eybisi commented Jun 22, 2018

and enter handle_function(0x38010)
0x38010 is ALLATORIxDEMO's adress

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment