Skip to content

Instantly share code, notes, and snippets.

@secrary

secrary/Extract_wmighost.py

Last active August 2, 2017 06:09
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save secrary/c4fd3273a24da449795cc47f2e4378ef to your computer and use it in GitHub Desktop.
Save secrary/c4fd3273a24da449795cc47f2e4378ef to your computer and use it in GitHub Desktop.
Download ZIP
sha256: a6ff8dfe654da70390cd71626cdca8a6f6a0d7980cd7d82269373737b04fd206
Raw
Extract_wmighost.py
input_ = input("WMIGhost sample: ")
with open(input_, 'rb+') as file:
data = file.read()[0x3028: 0x3028 + 0x137A]
with open(input_ + "_func.txt", "w") as outfile:
for i, n in enumerate(data):
outfile.write(chr(data[i] ^ 0x63 ^ 0xe9))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment