herrcore

import idaapi, idc, idautils


class DecryptorError(Exception):
    pass


def rc4crypt(key, data):
    x = 0
    box = range(256)

herrcore

#!/usr/bin/env python2.7
#####################################################################################
##
## Simple Abstract Syntax Tree Example for Tokens x, const, add, sub
##
## Reference: https://www.youtube.com/watch?v=kzDuHh6kolk - tutorial by Jack Mott
##
#####################################################################################

herrcore

def decrypt(data, video):
    video_len = len(video)
    if video_len > 0xa00000:
        video_len = 0xa00000
    video_offset_count = video_len /len(data)
    out = ''
    for i in range(len(data)):
        out += chr(ord(data[i]) ^ ord(video[video_offset_count*i]))
    return out

herrcore

def decrypt(key, data):
    out = ''
    for d in data:
        for k in key:
            d = chr(ord(d) ^ ord(k))
        out += chr(~ord(d) & 255)
    return out


def decrypt_string(ea):

herrcore

#!/usr/local/bin/env python

########################################################################################################
##
## Decrypts the AdWind configiration files! 
##  ** May also work for other files **
##
##
## All credit to Michael Helwig for the original Java implementation:
## https://github.com/mhelwig/adwind-decryptor

herrcore

import idautils 
import idaapi
import idc


def string_decrypt(data_ea, data_len):
    data = idc.GetManyBytes(data_ea, data_len)
    key = '89798798798g79er$'
    out = 'str_'
    for i in range(0 , len(data)):

herrcore

Moved: https://github.com/OALabs/hexcopy-ida

herrcore

################################################################################
##
## Junk Hide for PYKSPA
##
## Author: @herrcore
##
## Hide junk code:
##  mov al <something>
##  mov al <something>
##  mov al <something>

herrcore

import idautils 
import idaapi

def memdump(ea, size, file):
    data = idc.GetManyBytes(ea, size)
    with open(file, "wb") as fp:
        fp.write(data)
        print "Memdump Success!"

herrcore

// SandBoxTest.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"
#include <windows.h>
#include <tchar.h>
#include <stdio.h>
#include <strsafe.h>
#include <string>
using namespace std;