Skip to content

Instantly share code, notes, and snippets.

@WitherOrNot
Created April 25, 2026 06:08
Show Gist options
  • Select an option

  • Save WitherOrNot/de2fb854b31aa142cbebf4cf60e7c25f to your computer and use it in GitHub Desktop.

Select an option

Save WitherOrNot/de2fb854b31aa142cbebf4cf60e7c25f to your computer and use it in GitHub Desktop.
htpec page corruption fix
from sys import argv
from x64dbg_automate import X64DbgClient
client = X64DbgClient(argv[1])
client.attach_session(X64DbgClient.list_sessions()[0].pid)
base_addr = client.eval_sync(argv[2])[0]
start_rva = int(argv[3], 16)
end_rva = start_rva + int(argv[4], 16)
io4 = int(argv[5])
data = bytearray(client.read_memory(base_addr, end_rva))
start_pg = start_rva >> 12
end_pg = end_rva >> 12
def ror(x, n):
return (x >> n) | ((x << (32 - n)) & ((1 << 32) - 1))
def decrypt_page(data, offset):
offset = (offset & 0xFFFFF000)
page_num = (offset >> 12)
seed = page_num
for i in range(io4, 0x100):
val = (i + ror(seed, 15)) & 0xFFFFFFFF
seed = (i + val) & 0xFFFFFFFF
xor_val = seed & 0xFF
xor_offset = val & 0xF
# input(f"{hex(base_addr + offset + xor_offset + (0x10 * i))} {hex(data[offset + xor_offset + (0x10 * i)])} {hex(data[offset + xor_offset + (0x10 * i)] ^ xor_val)}")
data[offset + xor_offset + (0x10 * i)] ^= xor_val
for pg in range(start_pg, end_pg):
decrypt_page(data, pg << 12)
client.write_memory(base_addr, data)
client.detach_session()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment