Skip to content

Instantly share code, notes, and snippets.

@herrcore
Last active January 20, 2017 18:04
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save herrcore/3c43cec3389a6a516343bebf63da2a98 to your computer and use it in GitHub Desktop.
Save herrcore/3c43cec3389a6a516343bebf63da2a98 to your computer and use it in GitHub Desktop.
Decrypt hancitor downloads; first 8 bytes xor key, then lznt1 decompress
try:
import lznt1
except:
print "Cannot import lznt1, try this lib: https://gist.github.com/herrcore/344ba2ea540f622b52efba858050539f"
import struct
def decrypt(data):
key = data[:8]
data = data[8:]
out=''
for i in range(0,len(data)):
i_key = i % len(key)
out += chr(ord(key[i_key])^ord(data[i]))
pe = lznt1.dCompressBuf(out)
return pe
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment