Python interpreter FEEDFACE extraction

python_FEEDFACE_extraction.py

"""
RC4 Decryption Utility for Malicious Payload Extraction
"""
import sys
import pathlib
import binascii
from Cryptodome.Cipher import ARC4

def main():
    if len(sys.argv) != 3:
        print(f"Usage: {sys.argv[0]} <input_file> <output_file>")
        sys.exit(1)

    input_path = pathlib.Path(sys.argv[1])
    output_path = pathlib.Path(sys.argv[2])

    try:
        data = input_path.read_bytes()
    except FileNotFoundError:
        print(f"[!] Error: Input file '{input_path}' not found.")
        sys.exit(1)
    except PermissionError:
        print(f"[!] Error: Permission denied reading '{input_path}'.")
        sys.exit(1)
    except Exception as e:
        print(f"[!] Error reading input file: {e}")
        sys.exit(1)

    marker = binascii.unhexlify("FEEDFACE")
    index = data.find(marker)

    if index == -1:
        print(f"[!] Error: Marker 'FEEDFACE' not found in input file.")
        sys.exit(1)

    try:
        encrypted_payload = data[index + len(marker):]
        decipher = ARC4.new(b"123456")
        decrypted = decipher.decrypt(encrypted_payload)
        output_path.write_bytes(decrypted)
        print("[+] Decryption successful. Output written to:", output_path)
    except Exception as e:
        print(f"[!] Error during decryption or writing output: {e}")
        sys.exit(1)

if __name__ == "__main__":
    main()