-
Notifications
You must be signed in to change notification settings - Fork 0
/
emotet-decode.idc
77 lines (66 loc) · 1.94 KB
/
emotet-decode.idc
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
auto decode = 0x401b70; // Address may be different based on the file being analyzed
auto xref;
// Find all code references (xref) to the decode function
for(xref = RfirstB(decode); xref != BADADDR; xref = RnextB(decode,xref)){
Message("xref: %x\n",xref);
auto i = 0;
auto ecx = 0; // ecx holds the offset to the encrypted data
auto edx = 0; // edx holds the key
auto inst = xref;
auto op, s, comm;
// Iterating backwards from the xref
// through max 100 instructions to find the values
// moved to registers ecx and edx
while((i < 100) & ((ecx == 0) || (edx == 0))){
inst = FindCode(inst,0x00); // flag set to backwards
op = GetDisasm(inst); // get the disassembly string to match
if(ecx == 0){
s = strstr(op, "mov ecx");
if(s == 0){
comm = inst; // save instruction addr for commenting
ecx = Dword(inst+0x1);
Message("ecx: %x\n",ecx);
}
}
if(edx == 0){
s = strstr(op, "mov edx");
if(s == 0){
edx = Dword(inst+0x1);
Message("edx: %x\n",edx);
}
}
i++;
}
if((ecx != 0) & (edx != 0)){
// Dword(Offset) xor key = string length
// ecx = Offset
// edx = key
auto strLen = Dword(ecx) ^ edx;
Message("String length: %d \n",strLen);
// reset original bytes
auto k;
auto l = ecx+0x4;
auto decoded = ecx+0x4;
for(k=0; k<strLen; k++){
PatchByte(l,GetOriginalByte(l));
l++;
}
// xor the string and Patch the bytes
auto d;
auto j = 0;
Message("String: ");
while(j < strLen){
ecx = ecx + 0x4;
d = Dword(ecx) ^ edx;
PatchDword(ecx,d);
MakeStr(decoded,decoded+strLen);
MakeComm(comm,Name(decoded));
Message("%s",d);
j = j + 0x4;
}
}
else {
Message("No ecx or edx found. \n");
}
Message("\n\n");
}