Decode strings in Ghidra from sample 11864ec73e6226f52a1e6e4074b33e89

bitter_string_decoder.py

from ghidra.program.model.listing import CodeUnit

decrypt_func = 0x004039a0

def decode(offset):
    count = 0
    res = b''
    b = getByte(toAddr(offset))
    while b != 0x0:
        try:
            if b == 0x20:
            	res += ' '
            elif count & 3 == 0:
                res += chr(b - 0x3)   
            else:
                res += chr(b + 0x4)
        except ValueError:
            pass
        count += 2
        b = getByte(toAddr(offset+count))
    return res

def seek_back(inst):
    while True:
    	prev = getInstructionBefore(inst)
        #print "Searching %s" % prev.toString()
    	if "PUSH" in prev.toString():
            break
        inst = prev
    return prev

refs = getReferencesTo(toAddr(decrypt_func))
for r in refs:
    callee = r.getFromAddress()
    inst = getInstructionAt(callee)
    push_instr = seek_back(inst)
    #push_instr = getInstructionBefore(inst)
    if "PUSH" in push_instr.toString():
        offset = push_instr.toString().split(' ')[-1]
        comment =  decode(int(offset,16))
        print 'Adding comment %s to %s' % (comment, inst.getAddress())
        cu = currentProgram.getListing().getCodeUnitAt(inst.getAddress())
        cu.setComment(CodeUnit.PRE_COMMENT, comment)