Permalink
Switch branches/tags
Nothing to show
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
executable file 127 lines (106 sloc) 3.24 KB
#!/usr/bin/python
import pefile
import sys, os
# Extract PE File
# v 0.1
# Need https://code.google.com/p/pefile et on lui doit TOUT
#
# Extract PEFile from "Dump" ... for a EXE not loaded in memory
#
# Copyleft Thanat0s
# http://Thanat0s.trollprod.org
#
# Licence GNU GPL
def decrotte(filearray, text):
roll = ["|","/","-","\\" ]
i=0
dumped = False
sys.stdout.flush()
sys.stdout.write( "\r"+int(columns)*" "+"\r")
for M in range(0,len(filearray)-1):
if int(filearray[M]) == ord('M') and int(filearray[M+1]) == ord('Z') :
i=(i+1) % 4
sys.stdout.write (" >Seeking %s %s\r" % (roll[i],text))
sys.stdout.flush()
try:
PE = pefile.PE(data="".join(chr(b) for b in filearray[M::]))
for section in PE.sections: # va chercher les data la dernierse section fait fois
location = section.PointerToRawData
locationadd = section.SizeOfRawData
Z = location + locationadd
with open(('PE_%d.exe' % M), 'w') as outfile:
outfile.write(filearray[M:M+Z])
dumped = True
print ('\n[*] Found PE_%d.exe %d bytes saved\n' % (M,Z)),
except:
pass
#sys.stdout.write( "\r"+int(columns)*" "+"\r")
return dumped
def win():
print"\n[i] I was victorious..."
sys.exit(0)
def xor(key,inc, filearray):
filearrayout = filearray
for I in range (0,len(filearrayout)): # Pas 0, s'occuppe pas de l'exe host
filearrayout[I] = filearrayout[I] ^ key
key = (key+inc) % 256
return filearrayout
rows, columns = os.popen('stty size', 'r').read().split()
# Needs two arg if not... help
if len(sys.argv) < 2:
print ('Extract PE from Dump')
print 'To Use: '+ sys.argv[0]+ ' filename [-xor]'
print ' [-xor] enable XOR Bruteforcing'
sys.exit(1)
FILENAME = sys.argv[1]
XOR = False
# Xor or not ?
if len(sys.argv) == 3:
if sys.argv[2].upper() == "-XOR":
print "[i] Ok I Will Brutalizing the XorCipher"
XOR = True
# Test if file exists
if not os.path.isfile(FILENAME):
print 'File not found'
sys.exit(1)
print "[i] Scanning %s" % FILENAME
with open(FILENAME, 'rb') as f:
filearray = bytearray(f.read())
result = decrotte(filearray,"Searching for PE")
if result:
win()
if XOR == False:
print "[!] Sorry nothing.. try with -XOR"
sys.exit(0)
print("[!] No PE found, will try the chinese style; SIMPLE XOR")
key = 1
while key < 256:
result = decrotte(xor(key,0,filearray),("8Bits Xor key %d"% key))
if result:
win()
key = key+1
print("[!] No PE found, will try the chinese style; XOR Shifted")
key = 1
while key < 256:
result = decrotte(xor(key,1,filearray),("8Bits Xor Inc key %d"% key))
if result:
win()
result = decrotte(xor(key,-1,filearray),("8Bits Xor Dec key %d"% key))
if result:
win()
key = key+1
print("[!] No PE found, will try the chinese style; XOR Shifted looking every offsets")
key = 1
while key < 256:
offset = 0
while offset < 256:
key2 = (key + offset) % 256
result = decrotte(xor(key2,1,filearray),("8Bits Xor Inc key %d offset %d"% (key,offset)))
if result:
win()
result = decrotte(xor(key2,-1,filearray),("8Bits Xor Dec key %d offset %d"% (key,offset)))
if result:
sys.exit(0)
offset = offset + 1
key=key+1
print "[!] Sorry nothing.. "