richhash.py

#!/usr/bin/env python
# -*- coding: utf-8 -*-
"""
Rich Hash standalone support for python3 - Thomas Roccia - @fr0gger_
"""

import hashlib
import sys
import re

def get_richhash(filename):
    # get richhash
    fh = open(filename, "rb")
    content = fh.read()

    try:
        xorkey = re.search(b"\x52\x69\x63\x68....\x00", content).group(0)[4:8]
        dansAnchor = []

        for x, y in zip(xorkey, b"\x44\x61\x6e\x53"):
            xored = x ^ y
            dansAnchor.append(xored)
        dansAnchor = bytes(dansAnchor)

    except:
        return "No Rich header available", "No Rich header available"

    richStart = re.search(re.escape(dansAnchor), content).start(0)
    richEnd = re.search(b"\x52\x69\x63\x68" + re.escape(xorkey), content).start(0)

    if richStart < richEnd:
        rhData = content[richStart:richEnd]
    else:
        raise Exception("The Rich header is not properly formated!")

    clearData = []
    for i in range(0, len(rhData)):
        clearData.append(rhData[i] ^ xorkey[i % len(xorkey)])

    clearData = bytes(clearData)

    xored_richhash = hashlib.md5(rhData).hexdigest().lower()
    clear_richhash = hashlib.md5(clearData).hexdigest().lower()
    fh.close()

    return xored_richhash, clear_richhash


xored, clear = get_richhash(sys.argv[1])

print(xored)
print(clear)