starfleetcadet75

#!/usr/bin/python2

"""
Petya Decryptor

Petya encrypts the MFT of the NTFS partition to prevent the user from accessing files.
It uses a flawed implementation of the Salsa20 stream cipher to perform the encryption.
Since Petya runs in 16-bit real mode, it cannot simply put 32-bit values into 16-bit registers.
To force the copied algorithm to work, the developers simply changed a few constant values of 32 down to 16.
This slight change reduces the keyspace by making a number of values in the keystream predictable.

starfleetcadet75

Adding Undo/Redo to a Script/Plugin

Wrap code inside bv.begin_undo_actions() and bv.commit_undo_actions().

Disassemble from the Python Console

Architecture['x86'].get_instruction_text(bv.read(here, 2), 0)

starfleetcadet75

// Searches all instructions for any references to undefined memory addresses.
// Useful for reversing firmware when you are still determining the correct memory mappings.
// Invalid addresses could indicate that you need to add a new segment at that address.
//
// @author starfleetcadet75
// @category Search
// @keybinding
// @menupath
// @toolbar

starfleetcadet75

[package]
name = "rfuse"
version = "0.1.0"

[dependencies]
fuse = "0.3"
libc = "0.2.41"
time = "0.1.40"
serde_json = "1.0.18"

starfleetcadet75

from Crypto.Cipher import AES
from Crypto import Random
import Crypto.Util.Counter

def padMessage(message, blockSize):
    pad = (blockSize - (len(message) % blockSize))
    return message + chr(pad) * pad

class Counter():
    def __init__(self, value):