Instantly share code, notes, and snippets.

Embed
What would you like to do?
Decode dridex strings
def dridex_decode_name(addr,idx,delm="\x00"):
addr += 8; tmp = ''; j = 0
xkey = GetManyBytes(addr,8)
for i in range(idx+1):
tmp = ''
while not tmp.endswith(delm):
tmp += chr(ord(xkey[j%8]) ^ Byte(addr+8+j))
j+=1
return tmp.strip(delm)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment