reference : https://www.hauri.co.kr/security/security_view.html?intSeq=15&page=1&keyfield=&key=
#-*-coding:utf-8 -*-
import base64
def Operator(key):
result = []
OPkey = [0x28, 0x4, 0x20, 0x20]
idx = 0
for a in key:
result.append(a + OPkey[idx])
idx += 1
return result
with open('str_info.txt', mode='rt') as f:
result = f.read()
result_list = result.split()
for b64_encStr in result_list:
b64_decStr = base64.b64decode(b64_encStr)
data = b64_decStr[4:]
key = b64_decStr[:4]
result = ""
if len(data)%4:
for padding in range(4-len(data)%4):
data += b"0"
for dataSplit in zip(*[list(data[z::4]) for z in range(4)]):
overflow = 0
for index in range(4):
if overflow:
key[index] = int(key[index])+int(overflow)
overflow = 0
if key[index] > 255:
overflow = int(str(hex(key[index]))[-3])
key[index] = int(str(hex(key[index]))[-2:], 16)
key[index] = int(key[index])
result += chr(dataSplit[index]^key[index])
key = Operator(key)
print(result)
'[+] etc..' 카테고리의 다른 글
yara_Crat_encStr (0) | 2020.06.05 |
---|---|
powershell_payload_shellcode.asm (0) | 2020.05.10 |
yara_signing_Exchange (0) | 2020.05.10 |
data structure (0) | 2020.04.30 |
yara_Nemty_memoryLoader (0) | 2019.09.20 |