Jump to content
×
×
  • Create New...

Phase Dump


Ken

Recommended Posts

  • Moon
import sys

def rc4_crypt(data, key):
	S = list(range(256))
	j = 0
	out = []
 
	for i in range(256):
		j = (j + S[i] + ord( key[i % len(key)] )) % 256
		S[i] , S[j] = S[j] , S[i]
 
	i = j = 0
	for char in data:
		i = ( i + 1 ) % 256
		j = ( j + S[i] ) % 256
		S[i] , S[j] = S[j] , S[i]
		out.append(chr(ord(char) ^ S[(S[i] + S[j]) % 256]))    
	return ''.join(out)
	
def dump_file(src, dst):
	src_file = open(src, 'rb')
	src_file.seek(16)
	file_content = src_file.read()
	src_file.close()
	
	if ord(file_content[0]) != 0x9F or ord(file_content[1]) != 0x54:
		print("Error: Not a valid Phase module")
		return
	
	decrypted_pe = rc4_crypt(file_content, "Phase")
	
	dst_file = open(dst, 'wb')
	dst_file.write(decrypted_pe)
	dst_file.close()
	
if len(sys.argv) < 3:
	print("use %s input_file output_file" % sys.argv[0]);
else:
	dump_file(sys.argv[1], sys.argv[2])

Description :

 

Decrypting win32 phase modules..

 

Kind Regards

Ken

Edited by Ken
  • Love 3

Do not be sorry, be better.

Link to comment
Share on other sites

  • Moon

Thanks, do you have some example of using for this code ?

print("use %s input_file output_file" % sys.argv[0]);

Kind Regards

Ken

  • Love 1

Do not be sorry, be better.

Link to comment
Share on other sites

Yeah, but what would you use it for? What are win32 phase modules even?

All I find are virus/trojan descriptions.

 

btw, credits?

Hidden Content

    Give reaction to this post to see the hidden content.

Which, ahem, "MalwareTech", this definitely sounds malware-y.

  • Love 5
Link to comment
Share on other sites

  • Moon

Yeah, but what would you use it for? What are win32 phase modules even?

All I find are virus/trojan descriptions.

 

btw, credits?

Hidden Content

    Give reaction to this post to see the hidden content.

Which, ahem, "MalwareTech", this definitely sounds malware-y.

 

I don't say this mine. You should be read something as carefull.

 

Kind Regards

Ken

Do not be sorry, be better.

Link to comment
Share on other sites

  • 9 months later...

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now


Important Information

Terms of Use / Privacy Policy / Guidelines / We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.