mikrotik_brd_decrypt.py

#!/usr/bin/env python3
import struct
import sys

def xor(a, b):
    return bytes(x ^ y for x, y in zip(a, b))

def cipher_stream(state, length):
    output = b''

    for i in range(0, length, 4):
        output += struct.pack('>I', state)
        state = (state + (state >> 0x1a | state << 0xe)) & 0xffffffff

    return output[:length]

state = 0x967e9839
brd = open(sys.argv[1], 'rb').read()
data = xor(brd, cipher_stream(state, len(brd)))
open(sys.argv[2], 'wb').write(data)