Last active
October 12, 2018 09:06
-
-
Save eybisi/636f16bb83ee1b72cbaccf149959d249 to your computer and use it in GitHub Desktop.
Finds all ALLATORIxDEMO functions, takes xor keys, decrypts all strings, adds decrypted string as comment to the encrypted strings
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
from idautils import * | |
from idaapi import * | |
from idc import * | |
from idautils import * | |
from types import * | |
def socksl(strinput,first_key,second_key): | |
length = len(strinput) | |
arr = [0 for i in range(length)] | |
i = length - 1 | |
while i >= 0: | |
char1 = strinput[i] | |
n = i - 1 | |
arr[i] = chr(ord(char1) ^ first_key) | |
if n < 0: | |
break | |
i = n - 1 | |
arr[n] = chr(ord(strinput[n]) ^ second_key) | |
return ''.join(arr) | |
def get_string(addr): | |
out = "" | |
while True: | |
if Byte(addr) != 0: | |
out += chr(Byte(addr)) | |
else: | |
break | |
addr += 1 | |
return out | |
def get_allatori_demos(): | |
l = [] | |
for segea in Segments(): | |
for funcea in Functions(segea, SegEnd(segea)): | |
functionName = GetFunctionName(funcea) | |
if "fsafsdfsfsdfsfsdfsd" in functionName: # "fsafsd.." is the ALLATORIxDEMO function if different function name used in dex change | |
cmt = GetType(funcea) | |
#print functionName | |
fc = cmt.split("(") | |
sc = fc[1].split(")") | |
tc = sc[0].split(",") | |
#print len(tc) | |
if len(tc) ==1: | |
if tc[0] == "java.lang.String *p0" : # sometimes p0 becomes arg0, look for function | |
print "HORRAY",functionName | |
l.append(funcea) | |
return l | |
def handle_function(func_start,f,s): | |
c = 0 | |
for h in FuncItems(func_start): | |
for xref in XrefsTo(h, 0): | |
c+=1 | |
#print 'from', hex(xref.frm), 'to', hex(xref.to), | |
inst = DecodePreviousInstruction(xref.frm) | |
if type(inst) is NoneType: | |
continue | |
if(get_operand_type(inst.ea,1) != 9): | |
continue | |
st = get_string(get_name_ea(inst.ea,print_operand(inst.ea,1))) | |
dec = socksl(st,f,s) | |
print c,st,"-->",dec | |
set_cmt(xref.frm,dec,1) | |
def do_job(): | |
l = get_allatori_demos() | |
print len(l) | |
for ea in l: | |
print ida_ua.ua_mnem(ea+0x22) | |
if ida_ua.ua_mnem(ea+0x22) == 'xor-int/lit8' and ida_ua.ua_mnem(ea+0x3c) == 'xor-int/lit8': # to filter bad functions | |
first = get_operand_value(ea+0x22,2) # 0x22 and 0x3c are offsets to xor instruction, if its different for you change it | |
second = get_operand_value(ea+0x3c,2) | |
print first,second | |
handle_function(ea,first,second) | |
print ea | |
else : | |
print "no" | |
do_job() |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment