Tool to help guess a files 256 byte XOR key by using frequency analysis
Python
Switch branches/tags
Nothing to show
Clone or download
Permalink
Failed to load latest commit information.
NoMoreXOR.py Initial push Jan 22, 2013
Readme.md Added blog post linkage. Jun 11, 2018

Readme.md

NoMoreXOR.py

Tool to help guess a files 256 byte XOR key by using frequency analysis.

Usage

usage: NoMoreXOR.py [-h] [-a] [-c] [-xor key] [-g] [-o outfile] [-y YARARULES]
					Path

Tool to help guess a files 256 byte XOR key by using frequency analysis.

positional arguments:
Path                  Path to file to be analyzed

optional arguments:
-h, --help            show this help message and exit
-a, --analyze         Auto analyze the specified file by looking for all
					  possible XOR keys then apply each of them & scan with
				      YARA to try and determine if it's the correct XOR key
					 (requires an output file)
-c, --convert         Convert the input file to a hex_file (requires an
					  output file)
-xor key              XOR the file with the supplied XOR key (requires an
					  output file)
-g, --guess           Print out information from the hex_file including most
					  common characters and possible SHA256 keys
-o outfile, --out outfile
					  Name of output file to create
-y YARARULES, --yararules YARARULES
					  Path to YARA rules to be used during auto analysis if
					  different than what's hardcoded

Additional Reading

You can find more information in this blog post.