ida反编译:
调用了6个函数对输入的字符串进行了加密,进入func1看看:
对输入的57个字符进行了xor
接下来进入xfun1:
很明显对前10个进行了xor,后面的函数几个同理。
接下来写python脚本解密:
data=[0x15,0x1F,0x12,0x14,0x08,0x3A,0x46,0x2C,0x07,0x1B,0x51,0x13,0x3F,0x57,0x08,0x05,0x3F,0x30,0x32,0x51,0x52,0x02,0x6E,0x78,0x16,0x7C,0x6E,0x61,0x70,0x48,0x1C,0x3B,0x32,0x2A,0x13,0x45,0x07,0x2A,0x18,0x0C,0x6E,0x41,0x70,0x04,0x06,0x6E,0x5C,0x00,0x42,0x45,0x70,0x5A,0x02,0x04,0x0E,0x4C]
print len(data)
for i in range(0,16):
data[i+40]^=0xef
for i in range(0,10):
data[i+30]^=0xab
for i in range(0,10):
data[i+20]^=0xef
for i in range(0,10):
data[i+10]^=0xbe
for i in range(0,10):
data[i]^=0xad
for i in range(0,56):
data[i]^=0xde
data=[chr(x) for x in data]
print ''.join(data)