Created
January 2, 2018 21:59
-
-
Save carloslopez1990/283a4735f5fb1fb653640d8c01a7437c to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<?php | |
// Carlos Lopez's Firmware LZMA Extractor for Windows | |
// Requires 7-Zip (http://www.7-zip.org/) | |
// <3 León, Nicaragua | |
// facebook.com/carlos.ernesto.1990 | |
// 22/11/2017 | |
if( !function_exists('hex2bin') ) { | |
function hex2bin( $input ) { | |
return pack("H*" , $input); | |
} | |
} | |
class CarlosLZMA { | |
private $fileContents = ''; | |
private $prospects = array(); | |
private $sessionid; | |
private $lzma_levels = array(); | |
private $found = 0; | |
public function __construct() { | |
$this->lzma_levels = array('5d00000100', | |
'5d00001000', | |
'5d00000800', | |
'5d00001000', | |
'5d00002000', | |
'5d00004000', | |
'5d00008000', | |
'5d00000001', | |
'5d00000002'); | |
$this->sessionid = md5('carloslzma'.session_id().microtime().rand(9, 9999)); | |
} | |
public function readBinaryFileAsHex($filename) { | |
$this->fileContents = bin2hex(file_get_contents($filename)); | |
} | |
public function generateProspects() { | |
$count = 1; | |
foreach($this->lzma_levels as $level) { | |
$prospects = preg_split('/'.$level.'[a-z0-9]{0,30}2020/', $this->fileContents); | |
$this->prospects[$level] = $prospects; | |
print 'Level '.$count.': '.count($this->prospects)." found\n"; | |
$count++; | |
} | |
} | |
public function addHeaderToProspects() { | |
mkdir('./'.$this->sessionid); | |
$count = 0; | |
foreach($this->lzma_levels as $level) { | |
foreach($this->prospects[$level] as $prospect) { | |
if( strlen($prospect) > 0 ) { | |
$prospect = $level.'0000001000000000002020'.$prospect; | |
file_put_contents('./'.$this->sessionid.'/'.$count.'.lzma', hex2bin($prospect)); | |
$count++; | |
} | |
} | |
} | |
} | |
public function extractFiles() { | |
chdir('./'.$this->sessionid); | |
$dir = opendir('./'); | |
while(($f = readdir($dir))!==false) { | |
$fparts = explode('.', $f); | |
if( $fparts[1] == 'lzma' ) { | |
shell_exec('"C:/Program Files/7-Zip/7z.exe" e ./'.$f.' -y -bb0'); | |
} | |
} | |
closedir($dir); | |
} | |
public function removeNonValidProspects() { | |
sleep(3); | |
$dir = opendir('./'); | |
while(($f = readdir($dir))!==false) { | |
$fparts = explode('.', $f); | |
if( ($fparts[1] == 'lzma') || ($fparts[1] != 'lzma' && filesize('./'.$f) < (50 * 1024)) && $f != '.' && $f != '..' ) | |
unlink('./'.$f); | |
else $this->found++; | |
} | |
closedir($dir); | |
} | |
public function getValidProspects() { | |
$validProspects = array(); | |
$subdirs = opendir('./'.$this->sessionid); | |
foreach($subdirs as $dir) { | |
if(is_dir('./'.$this->sessionid.'/'.$dir) && !in_array($dir, array('.', '..'))) | |
$validProspects[] = $dir; | |
} | |
return $validProspects; | |
} | |
public function getFound() { | |
return $this->found - 2; # . and .. | |
} | |
public function getSession() { | |
return $this->sessionid; | |
} | |
} | |
$clzma = new CarlosLZMA(); | |
$clzma->readBinaryFileAsHex( $argv[1] ); | |
$clzma->generateProspects(); | |
$clzma->addHeaderToProspects(); | |
$clzma->extractFiles(); | |
$clzma->removeNonValidProspects(); | |
print "\n Done... ".$clzma->getFound()." files extracted at ".$clzma->getSession(); | |
?> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment