Skip to content

Instantly share code, notes, and snippets.

@herrcore

herrcore/gootkit_packer_string_decrypt.py

Created March 3, 2018 22:35
Show Gist options
  • Star 6 You must be signed in to star a gist
  • Fork 2 You must be signed in to fork a gist
  • Save herrcore/473133aa1387ed0b08a67d1a221b5b09 to your computer and use it in GitHub Desktop.
Save herrcore/473133aa1387ed0b08a67d1a221b5b09 to your computer and use it in GitHub Desktop.
Download ZIP
Simple string decryptor for Gootkit packer (IDAPython script)
Raw
gootkit_packer_string_decrypt.py
import idautils
import idaapi
import idc
def string_decrypt(data_ea, data_len):
data = idc.GetManyBytes(data_ea, data_len)
key = '89798798798g79er$'
out = 'str_'
for i in range(0 , len(data)):
out += chr(ord(data[i]) ^ ord(key[i%len(key)]))
print out
idc.MakeName(data_ea, out)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment