Created
June 22, 2018 14:32
-
-
Save eybisi/5f4d3d9f832003a06ea9a82353626ec0 to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| def socksl(strinput): | |
| length = len(strinput) | |
| arr = [0 for i in range(length)] | |
| i = length - 1 | |
| while i >= 0: | |
| char1 = strinput[i] | |
| n = i - 1 | |
| arr[i] = chr(ord(char1) ^ 0x5c) | |
| if n < 0: | |
| break | |
| i = n - 1 | |
| arr[n] = chr(ord(strinput[n]) ^ 0x1e) | |
| return ''.join(arr) | |
| def get_string(addr): | |
| out = "" | |
| while True: | |
| if Byte(addr) != 0: | |
| out += chr(Byte(addr)) | |
| else: | |
| break | |
| addr += 1 | |
| return out | |
| def handle_function(func_start): | |
| for h in idautils.FuncItems(func_start): | |
| for xref in XrefsTo(h, 0): | |
| #print 'from', hex(xref.frm), 'to', hex(xref.to), | |
| inst = DecodePreviousInstruction(xref.frm) | |
| if(get_operand_type(inst.ea,1) != 9): | |
| continue | |
| st = get_string(get_name_ea(inst.ea,print_operand(inst.ea,1))) | |
| dec = socksl(st) | |
| print get_operand_type(inst.ea,1),c,st,"-->",dec | |
| set_cmt(xref.frm,dec,1) | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
and enter handle_function(0x38010)
0x38010 is ALLATORIxDEMO's adress