import sys import struct def hexprint(string, base = 0, word_size = 1, no_print = False): result = "" if len(string) == 0: return string = str(string) ascii = list("."*256) for i in range(1,0x7f): ascii[i] = chr(i) ascii[0x0] = "." ascii[0x7] = "." ascii[0x8] = "." ascii[0x9] = "." ascii[0xa] = "." ascii[0x1b] = "." ascii[0xd] = "." ascii[0xff] = "\xfe" ascii = "".join(ascii) offset = 0 while (offset+0x10) <= len(string): line = string[offset:(offset+0x10)] linebuf = " %016X " % (offset+base) if word_size == 1: for i in range(0,16): if i == 8: linebuf += " " linebuf += "%02X " % ord(line[i]) linebuf += " " for i in range(0,16): linebuf += ascii[ord(line[i])] if no_print == True: result += linebuf+"\n" else: print linebuf elif word_size == 4: for i in [0,4,8,0xc]: if i == 8: linebuf += " " linebuf += "%08X " % struct.unpack('I', line[i:i+4])[0] linebuf += " " for i in range(0,16): linebuf += ascii[ord(line[i])] if no_print == True: result += linebuf+"\n" else: print linebuf elif word_size == 8: for i in [0,8]: if i == 8: linebuf += " " linebuf += "%016X " % struct.unpack('Q', line[i:i+8])[0] linebuf += " " for i in range(0,16): linebuf += ascii[ord(line[i])] if no_print == True: result += linebuf+"\n" else: print linebuf offset += 0x10 if (len(string) % 0x10) > 0: linebuf = " %016X " % (offset+base) if word_size == 1: for i in range((len(string)-(len(string) % 0x10)),(len(string))): if i == 8: linebuf += " " linebuf += "%02X " % ord(string[i]) linebuf += " "*(0x10-(len(string) % 0x10)) linebuf += " " if (len(string)%0x10) < 8: linebuf += " " for i in range((len(string)-(len(string) % 0x10)),(len(string))): linebuf += ascii[ord(string[i])] if no_print == True: result += linebuf+"\n" else: print linebuf elif word_size == 4: linebuf = " %08X " % (offset+base) if (len(string) % 0x10) == 8: linebuf += "%08X " % struct.unpack('I', string[len(string)-4:])[0] linebuf += " "*(0x11-(len(string) % 0x10)) linebuf += " " for i in range((len(string)-(len(string) % 0x10)),(len(string))): linebuf += ascii[ord(string[i])] if no_print == True: result += linebuf+"\n" else: print linebuf elif word_size == 8: linebuf = " %016X " % (offset+base) if (len(string) % 0x10) == 8: linebuf += "%016X " % struct.unpack('Q', string[len(string)-8:])[0] linebuf += " "*(0x11-(len(string) % 0x10)) linebuf += " " for i in range((len(string)-(len(string) % 0x10)),(len(string))): linebuf += ascii[ord(string[i])] if no_print == True: result += linebuf+"\n" else: print linebuf return result.decode("cp1252") def __ROL8__(num, index): return align_64((num<>(64-index))) def __ROR8__(num, index): return align_64((num>>index)|((num&((2**index)-1))<<(64-index))) def align_64(num): return (num&0xffffffffffffffff) def crypto_it(a1, a2, a3, a4): v331 = a4 v330 = a3 v329 = a2 v328 = a1 v4 = struct.unpack("Q",a1[24:24+8])[0] v5 = struct.unpack("Q",a1[16:16+8])[0] result = a2 v322 = struct.unpack("Q",a1[24:24+8])[0] v7 = a1 v321 = 0 while ( v321 == 0 ): v8 = struct.unpack("Q",v7[0x38:0x38+8])[0] v9 = struct.unpack("Q",v7[48:48+8])[0] v10 = struct.unpack("Q",v7[32:32+8])[0] v323 = align_64(a4 + v5) v11 = align_64(a4 + v5) v12 = struct.unpack("Q",v7[40:40+8])[0] v13 = align_64((a4 + v5) ^ v4) v14 = align_64(v10 ^ v12 ^ v9 ^ v8 ^ 0x1BD11BDAA9FC1A22) Dst = struct.unpack("Q",result[0:8])[0] v325 = struct.unpack("Q",result[8:0x10])[0] v326 = struct.unpack("Q",result[0x10:0x18])[0] v327 = struct.unpack("Q",result[0x18:0x20])[0] v329 = v329[32:] v15 = align_64(v325) v16 = align_64(v326) v17 = align_64(v11 + v325 + v12) v18 = align_64(v327) v19 = align_64(v10 + v17 + Dst) v17 = __ROL8__(v17, 14) v20 = align_64(v19 ^ v17) v21 = align_64(v322 + v9 + v327 + v8 + v326) v22 = __ROL8__(v327 + v8, 16) v23 = align_64(v21 ^ v22) v24 = align_64(v20 + v21) v25 = align_64(v23 + v19) v23 = __ROR8__(v23, 12) v26 = align_64(v25 ^ v23) v20 = __ROR8__(v20, 7) v27 = align_64(v24 ^ v20) v28 = align_64(v26 + v24) v29 = align_64(v27 + v25) v27 = __ROL8__(v27, 23) v30 = align_64(v29 ^ v27) v26 = __ROR8__(v26, 24) v31 = align_64(v28 ^ v26) v32 = align_64(v30 + v28) v33 = align_64(v31 + v29) v30 = __ROR8__(v30, 27) v34 = align_64(v322 + v9 + (v32 ^ v30)) v31 = __ROL8__(v31, 5) v35 = align_64((v33 ^ v31) + v14 + 1) v36 = align_64(v34 + v12 + v33) v34 = __ROL8__(v34, 25) v37 = align_64(v36 ^ v34) v38 = align_64(v8 + v35 + v13 + v32) v35 = __ROR8__(v35, 31) v39 = align_64(v38 ^ v35) v40 = align_64(v37 + v38) v41 = align_64(v39 + v36) v39 = __ROR8__(v39, 18) v42 = align_64(v41 ^ v39) v37 = __ROL8__(v37, 12) v43 = align_64(v40 ^ v37) v44 = align_64(v42 + v40) v45 = align_64(v43 + v41) v43 = __ROR8__(v43, 6) v46 = align_64(v45 ^ v43) v42 = __ROL8__(v42, 22) v47 = align_64(v44 ^ v42) v48 = align_64(v46 + v44) v49 = align_64(v47 + v45) v46 = __ROL8__(v46, 32) v50 = align_64(v8 + v13 + (v48 ^ v46)) v47 = __ROL8__(v47, 32) v51 = align_64(v49 ^ v47) v52 = align_64(v50 + v9 + v49) v50 = __ROL8__(v50, 14) v53 = align_64(v51 + v10 + 2) v54 = align_64(v52 ^ v50) v55 = align_64(v323 + v53 + v14 + v48) v53 = __ROL8__(v53, 16) v56 = align_64(v55 ^ v53) v57 = align_64(v54 + v55) v58 = align_64(v56 + v52) v56 = __ROR8__(v56, 12) v59 = align_64(v58 ^ v56) v54 = __ROR8__(v54, 7) v60 = align_64(v57 ^ v54) v61 = align_64(v59 + v57) v62 = align_64(v60 + v58) v60 = __ROL8__(v60, 23) v63 = align_64(v62 ^ v60) v59 = __ROR8__(v59, 24) v64 = align_64(v61 ^ v59) v65 = align_64(v63 + v61) v66 = align_64(v64 + v62) v63 = __ROR8__(v63, 27) v67 = align_64(v323 + v14 + (v65 ^ v63)) v64 = __ROL8__(v64, 5) v68 = align_64((v66 ^ v64) + v12 + 3) v69 = align_64(v67 + v8 + v66) v67 = __ROL8__(v67, 25) v70 = align_64(v69 ^ v67) v71 = align_64(v322 + v68 + v10 + v65) v68 = __ROR8__(v68, 31) v72 = align_64(v71 ^ v68) v73 = align_64(v70 + v71) v74 = align_64(v72 + v69) v72 = __ROR8__(v72, 18) v75 = align_64(v74 ^ v72) v70 = __ROL8__(v70, 12) v76 = align_64(v73 ^ v70) v77 = align_64(v75 + v73) v78 = align_64(v76 + v74) v76 = __ROR8__(v76, 6) v79 = align_64(v78 ^ v76) v75 = __ROL8__(v75, 22) v80 = align_64(v77 ^ v75) v81 = align_64(v79 + v77) v82 = align_64(v80 + v78) v79 = __ROL8__(v79, 32) v83 = align_64(v322 + v10 + (v81 ^ v79)) v80 = __ROL8__(v80, 32) v84 = align_64(v82 ^ v80) v85 = align_64(v83 + v14 + v82) v86 = align_64(v84 + v9 + 4) v83 = __ROL8__(v83, 14) v87 = align_64(v85 ^ v83) v88 = align_64(v12 + v86 + v13 + v81) v86 = __ROL8__(v86, 16) v89 = align_64(v88 ^ v86) v90 = align_64(v87 + v88) v91 = align_64(v89 + v85) v89 = __ROR8__(v89, 12) v92 = align_64(v91 ^ v89) v87 = __ROR8__(v87, 7) v93 = align_64(v90 ^ v87) v94 = align_64(v92 + v90) v95 = align_64(v93 + v91) v93 = __ROL8__(v93, 23) v96 = align_64(v95 ^ v93) v92 = __ROR8__(v92, 24) v97 = align_64(v94 ^ v92) v98 = align_64(v96 + v94) v99 = align_64(v97 + v95) v96 = __ROR8__(v96, 27) v100 = align_64(v12 + v13 + (v98 ^ v96)) v97 = __ROL8__(v97, 5) v101 = align_64(v99 ^ v97) v102 = align_64(v100 + v10 + v99) v100 = __ROL8__(v100, 25) v103 = align_64(v101 + v8 + 5) v104 = align_64(v102 ^ v100) v105 = align_64(v323 + v103 + v9 + v98) v103 = __ROR8__(v103, 31) v106 = align_64(v105 ^ v103) v107 = align_64(v104 + v105) v108 = align_64(v106 + v102) v106 = __ROR8__(v106, 18) v109 = align_64(v108 ^ v106) v104 = __ROL8__(v104, 12) v110 = align_64(v107 ^ v104) v111 = align_64(v109 + v107) v112 = align_64(v110 + v108) v110 = __ROR8__(v110, 6) v113 = align_64(v112 ^ v110) v109 = __ROL8__(v109, 22) v114 = align_64(v111 ^ v109) v115 = align_64(v113 + v111) v116 = align_64(v114 + v112) v113 = __ROL8__(v113, 32) v117 = align_64(v323 + v9 + (v115 ^ v113)) v114 = __ROL8__(v114, 32) v118 = align_64(v116 ^ v114) v119 = align_64(v117 + v12 + v116) v117 = __ROL8__(v117, 14) v120 = align_64(v118 + v14 + 6) v121 = align_64(v119 ^ v117) v122 = align_64(v322 + v120 + v8 + v115) v120 = __ROL8__(v120, 16) v123 = align_64(v122 ^ v120) v124 = align_64(v121 + v122) v125 = align_64(v123 + v119) v123 = __ROR8__(v123, 12) v126 = align_64(v125 ^ v123) v121 = __ROR8__(v121, 7) v127 = align_64(v124 ^ v121) v128 = align_64(v126 + v124) v129 = align_64(v127 + v125) v127 = __ROL8__(v127, 23) v130 = align_64(v129 ^ v127) v126 = __ROR8__(v126, 24) v131 = align_64(v128 ^ v126) v132 = align_64(v130 + v128) v133 = align_64(v131 + v129) v130 = __ROR8__(v130, 27) v134 = align_64(v322 + v8 + (v132 ^ v130)) v131 = __ROL8__(v131, 5) v135 = align_64(v133 ^ v131) v136 = align_64(v134 + v9 + v133) v134 = __ROL8__(v134, 25) v137 = align_64(v135 + v10 + 7) v138 = align_64(v136 ^ v134) v139 = align_64(v14 + v137 + v13 + v132) v137 = __ROR8__(v137, 31) v140 = align_64(v139 ^ v137) v141 = align_64(v138 + v139) v142 = align_64(v140 + v136) v140 = __ROR8__(v140, 18) v143 = align_64(v142 ^ v140) v138 = __ROL8__(v138, 12) v144 = align_64(v141 ^ v138) v145 = align_64(v143 + v141) v146 = align_64(v144 + v142) v144 = __ROR8__(v144, 6) v147 = align_64(v146 ^ v144) v143 = __ROL8__(v143, 22) v148 = align_64(v145 ^ v143) v149 = align_64(v147 + v145) v150 = align_64(v148 + v146) v147 = __ROL8__(v147, 32) v151 = align_64(v14 + v13 + (v149 ^ v147)) v148 = __ROL8__(v148, 32) v152 = align_64((v150 ^ v148) + v12 + 8) v153 = align_64(v151 + v8 + v150) v151 = __ROL8__(v151, 14) v154 = align_64(v153 ^ v151) v155 = align_64(v323 + v152 + v10 + v149) v152 = __ROL8__(v152, 16) v156 = align_64(v155 ^ v152) v157 = align_64(v154 + v155) v158 = align_64(v156 + v153) v156 = __ROR8__(v156, 12) v159 = align_64(v158 ^ v156) v154 = __ROR8__(v154, 7) v160 = align_64(v157 ^ v154) v161 = align_64(v159 + v157) v162 = align_64(v160 + v158) v160 = __ROL8__(v160, 23) v163 = align_64(v162 ^ v160) v159 = __ROR8__(v159, 24) v164 = align_64(v161 ^ v159) v165 = align_64(v163 + v161) v166 = align_64(v164 + v162) v163 = __ROR8__(v163, 27) v167 = align_64(v323 + v10 + (v165 ^ v163)) v164 = __ROL8__(v164, 5) v168 = align_64(v166 ^ v164) v169 = align_64(v167 + v14 + v166) v167 = __ROL8__(v167, 25) v170 = align_64(v168 + v9 + 9) v171 = align_64(v169 ^ v167) v172 = align_64(v322 + v170 + v12 + v165) v170 = __ROR8__(v170, 31) v173 = align_64(v172 ^ v170) v174 = align_64(v171 + v172) v175 = align_64(v173 + v169) v173 = __ROR8__(v173, 18) v176 = align_64(v175 ^ v173) v171 = __ROL8__(v171, 12) v177 = align_64(v174 ^ v171) v178 = align_64(v176 + v174) v179 = align_64(v177 + v175) v177 = __ROR8__(v177, 6) v180 = align_64(v179 ^ v177) v176 = __ROL8__(v176, 22) v181 = align_64(v178 ^ v176) v182 = align_64(v180 + v178) v183 = align_64(v181 + v179) v180 = __ROL8__(v180, 32) v184 = align_64(v322 + v12 + (v182 ^ v180)) v181 = __ROL8__(v181, 32) v185 = align_64(v183 ^ v181) v186 = align_64(v184 + v10 + v183) v184 = __ROL8__(v184, 14) v187 = align_64(v185 + v8 + 10) v188 = align_64(v186 ^ v184) v189 = align_64(v9 + v187 + v13 + v182) v187 = __ROL8__(v187, 16) v190 = align_64(v189 ^ v187) v191 = align_64(v188 + v189) v192 = align_64(v190 + v186) v190 = __ROR8__(v190, 12) v193 = align_64(v192 ^ v190) v188 = __ROR8__(v188, 7) v194 = align_64(v191 ^ v188) v195 = align_64(v193 + v191) v196 = align_64(v194 + v192) v194 = __ROL8__(v194, 23) v197 = align_64(v196 ^ v194) v193 = __ROR8__(v193, 24) v198 = align_64(v195 ^ v193) v199 = align_64(v197 + v195) v200 = align_64(v198 + v196) v197 = __ROR8__(v197, 27) v201 = align_64(v9 + v13 + (v199 ^ v197)) v198 = __ROL8__(v198, 5) v202 = align_64(v200 ^ v198) v203 = align_64(v201 + v12 + v200) v201 = __ROL8__(v201, 25) v204 = align_64(v202 + v14 + 11) v205 = align_64(v203 ^ v201) v206 = align_64(v323 + v204 + v8 + v199) v204 = __ROR8__(v204, 31) v207 = align_64(v206 ^ v204) v208 = align_64(v205 + v206) v209 = align_64(v207 + v203) v207 = __ROR8__(v207, 18) v210 = align_64(v209 ^ v207) v205 = __ROL8__(v205, 12) v211 = align_64(v208 ^ v205) v212 = align_64(v210 + v208) v213 = align_64(v211 + v209) v211 = __ROR8__(v211, 6) v214 = align_64(v213 ^ v211) v210 = __ROL8__(v210, 22) v215 = align_64(v212 ^ v210) v216 = align_64(v214 + v212) v217 = align_64(v215 + v213) v214 = __ROL8__(v214, 32) v218 = align_64(v323 + v8 + (v216 ^ v214)) v215 = __ROL8__(v215, 32) v219 = align_64(v217 ^ v215) v220 = align_64(v218 + v9 + v217) v218 = __ROL8__(v218, 14) v221 = align_64(v219 + v10 + 12) v222 = align_64(v220 ^ v218) v223 = align_64(v322 + v221 + v14 + v216) v221 = __ROL8__(v221, 16) v224 = align_64(v223 ^ v221) v225 = align_64(v222 + v223) v226 = align_64(v224 + v220) v224 = __ROR8__(v224, 12) v227 = align_64(v226 ^ v224) v222 = __ROR8__(v222, 7) v228 = align_64(v225 ^ v222) v229 = align_64(v227 + v225) v230 = align_64(v228 + v226) v228 = __ROL8__(v228, 23) v231 = align_64(v230 ^ v228) v227 = __ROR8__(v227, 24) v232 = align_64(v229 ^ v227) v233 = align_64(v231 + v229) v234 = align_64(v232 + v230) v231 = __ROR8__(v231, 27) v235 = align_64(v322 + v14 + (v233 ^ v231)) v232 = __ROL8__(v232, 5) v236 = align_64((v234 ^ v232) + v12 + 13) v237 = align_64(v235 + v8 + v234) v235 = __ROL8__(v235, 25) v238 = align_64(v237 ^ v235) v239 = align_64(v10 + v236 + v13 + v233) v236 = __ROR8__(v236, 31) v240 = align_64(v239 ^ v236) v241 = align_64(v238 + v239) v242 = align_64(v240 + v237) v240 = __ROR8__(v240, 18) v243 = align_64(v242 ^ v240) v238 = __ROL8__(v238, 12) v244 = align_64(v241 ^ v238) v245 = align_64(v243 + v241) v246 = align_64(v244 + v242) v244 = __ROR8__(v244, 6) v247 = align_64(v246 ^ v244) v243 = __ROL8__(v243, 22) v248 = align_64(v245 ^ v243) v249 = align_64(v247 + v245) v250 = align_64(v248 + v246) v247 = __ROL8__(v247, 32) v251 = align_64(v10 + v13 + (v249 ^ v247)) v248 = __ROL8__(v248, 32) v252 = align_64(v250 ^ v248) v253 = align_64(v251 + v14 + v250) v251 = __ROL8__(v251, 14) v254 = align_64(v252 + v9 + 14) v255 = align_64(v253 ^ v251) v256 = align_64(v323 + v254 + v12 + v249) v254 = __ROL8__(v254, 16) v257 = align_64(v256 ^ v254) v258 = align_64(v255 + v256) v259 = align_64(v257 + v253) v257 = __ROR8__(v257, 12) v260 = align_64(v259 ^ v257) v255 = __ROR8__(v255, 7) v261 = align_64(v258 ^ v255) v262 = align_64(v260 + v258) v263 = align_64(v261 + v259) v261 = __ROL8__(v261, 23) v264 = align_64(v263 ^ v261) v260 = __ROR8__(v260, 24) v265 = align_64(v262 ^ v260) v266 = align_64(v264 + v262) v267 = align_64(v265 + v263) v264 = __ROR8__(v264, 27) v268 = align_64(v323 + v12 + (v266 ^ v264)) v265 = __ROL8__(v265, 5) v269 = align_64(v267 ^ v265) v270 = align_64(v268 + v10 + v267) v268 = __ROL8__(v268, 25) v271 = align_64(v269 + v8 + 15) v272 = align_64(v270 ^ v268) v273 = align_64(v322 + v271 + v9 + v266) v271 = __ROR8__(v271, 31) v274 = align_64(v273 ^ v271) v275 = align_64(v272 + v273) v276 = align_64(v274 + v270) v274 = __ROR8__(v274, 18) v277 = align_64(v276 ^ v274) v272 = __ROL8__(v272, 12) v278 = align_64(v275 ^ v272) v279 = align_64(v277 + v275) v280 = align_64(v278 + v276) v278 = __ROR8__(v278, 6) v281 = align_64(v280 ^ v278) v277 = __ROL8__(v277, 22) v282 = align_64(v279 ^ v277) v283 = align_64(v281 + v279) v284 = align_64(v282 + v280) v281 = __ROL8__(v281, 32) v285 = align_64(v322 + v9 + (v283 ^ v281)) v282 = __ROL8__(v282, 32) v286 = align_64(v284 ^ v282) v287 = align_64(v285 + v12 + v284) v285 = __ROL8__(v285, 14) v288 = align_64(v286 + v14 + 16) v289 = align_64(v287 ^ v285) v290 = align_64(v8 + v288 + v13 + v283) v288 = __ROL8__(v288, 16) v291 = align_64(v290 ^ v288) v292 = align_64(v289 + v290) v293 = align_64(v291 + v287) v291 = __ROR8__(v291, 12) v294 = align_64(v293 ^ v291) v289 = __ROR8__(v289, 7) v295 = align_64(v292 ^ v289) v296 = align_64(v294 + v292) v297 = align_64(v295 + v293) v295 = __ROL8__(v295, 23) v298 = align_64(v297 ^ v295) v294 = __ROR8__(v294, 24) v299 = align_64(v296 ^ v294) v300 = align_64(v298 + v296) v301 = align_64(v299 + v297) v298 = __ROR8__(v298, 27) v302 = align_64(v13 + (v300 ^ v298)) v5 = align_64(v323) v303 = align_64(v8 + v302) v299 = __ROL8__(v299, 5) v304 = align_64(v301 ^ v299) v305 = align_64(v303 + v9 + v301) v303 = __ROL8__(v303, 25) v306 = align_64(v304 + v10 + 17) v307 = align_64(v305 ^ v303) v308 = align_64(v323 + v306 + v14 + v300) v306 = __ROR8__(v306, 31) v309 = align_64(v308 ^ v306) v7 = v328 v310 = align_64(v307 + v308) v311 = align_64(v309 + v305) v309 = __ROR8__(v309, 18) v312 = align_64(v311 ^ v309) v307 = __ROL8__(v307, 12) v313 = align_64(v310 ^ v307) v314 = align_64(v312 + v310) v315 = align_64(v313 + v311) v313 = __ROR8__(v313, 6) v316 = align_64(v315 ^ v313) v312 = __ROL8__(v312, 22) v317 = align_64(v314 ^ v312) v318 = align_64(v316 + v314) v319 = align_64(v317 + v315) v316 = __ROL8__(v316, 32) v328[32:32+8] = struct.pack("Q",align_64(Dst ^ (v8 + v319))) v320 = align_64(v16 ^ (v322 + v318 + v10)) a4 = align_64(v331) v328[48:48+8] = struct.pack("Q",align_64(v320)) v317 = __ROL8__(v317, 32) v328[40:40+8] = struct.pack("Q",align_64((v323 + v14 + (v318 ^ v316)) ^ v15)) v328[56:56+8] = struct.pack("Q",align_64(v18 ^ ((v319 ^ v317) + v12 + 18))) v4 = align_64(v322 & 0xBFFFFFFFFFFFFFFF) v330 -= 1 if v330 < 1: v321 = 1 result = v329 v322 &= 0xBFFFFFFFFFFFFFFF v328[0x10:0x10+8] = struct.pack("Q",align_64(v323)) v328[0x18:0x18+8] = struct.pack("Q",align_64(v4)) return result def get_crypto_sum(datas): rcx = "\x20\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00" rcx += "\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\xc4" rcx += "\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00" rcx += "\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00" rdx = "SHA3"+"\x01\x00\x00\x00"+"\x20\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00" rcx = bytearray(rcx) rdx = bytearray(rdx) crypto_it(rcx,rdx,1,0x20) rcx[0:0x10] = "\x20\x00\x00\x00"+"\x00\x00\x00\x00"+chr(len(datas))+"\x00\x00\x00"+"\x00\x00\x00\x00" rcx[0x10:0x20] = "\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\xf0" rdx = datas rdx += "\x00"*(0x20-len(datas)) rdx = bytearray(rdx) crypto_it(rcx,rdx,1,len(datas)) rcx[0:0x10] = "\x20\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00" rcx[0x10:0x20] = "\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\xff" rdx = "\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00"+"\x00\x00\x00\x00" rdx = bytearray(rdx) crypto_it(rcx,rdx,1,8) return ''.join(a for a in reversed(str(rcx[0x20:0x24]))) def b64(datas): import base64 return base64.b64encode(datas) def send_packet(host, port, header): import socket s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) # s.settimeout(2) try: s.connect((host, port)) s.send(header) data = s.recv(1024) s.close() except exception as e: print e s.close() return None return data def send_command_http(tag, command, code, host, port): key = "\x96u\x9e\xa0" sum1 = get_crypto_sum(key+(''.join(reversed(struct.pack("I", code))))+tag) header = "GET / HTTP/1.1\r\n" header += "SomeHeader: " sum2 = get_crypto_sum(sum1+tag) final_command = command[:7] checksum = 0 for ccar in final_command: checksum += ord(ccar) checksum = checksum & 0xff final_command = final_command+chr(checksum)+command[8:] header += sum1+tag+sum2+b64(final_command)+"\r\n" header += "Connect: blabla\r\n" header += "Connection: close\r\n\r\n" return send_packet(host, port, header) def interpret_command(datas): command = datas[:7] checksum = 0 for ccar in command: checksum += ord(ccar) checksum = checksum & 0xff if ord(datas[7]) != checksum or datas[4:6] != 'ra': print "Packet checksum is wrong :-(" return print " [*] checksum OK - Host is compromised" if len(sys.argv) < 3: print "Usage: %s IP PORT" % (sys.argv[0]) sys.exit(0) datas = send_command_http("ABCD", "ExaTrack", 0, sys.argv[1], int(sys.argv[2])) if datas == None or len(datas) < 1: print "No response from server" rcv_datas = datas.split("Connection: close\r\n\r\n") if len(rcv_datas) > 1 and len(rcv_datas[1]) >= 8: rcv_datas = rcv_datas[1] print "datas :" hexprint(rcv_datas) interpret_command(rcv_datas) else: hexprint(datas) print "Not an Uroburos reply."