Showing posts with label not. Show all posts
Showing posts with label not. Show all posts

Friday, November 9, 2018

IDA Python bitwise NOT Decode malware strings

If you have an area in memory that is xor obfuscated

debug007:0018FB06 db  9Ch ; œ
debug007:0018FB07 db  1Ah

and you have assembly code that decodes it with a bitwise not like this

.text:00401671 movzx   edx, byte ptr [eax+3]
.text:00401675 not     cl
.text:00401677 xor     dl, 75h


You can decode it to read it in IDA Python scripting by going to
file -> script command
and entering code like this
where 'd' is filled with the encoded hex values
and the print statements are filled with the individual xor values from the code

from textwrap import wrap
d = "9c1a"
bytes = wrap(d, 2)
for i in range(len(bytes)):
 bytes[i] = int(bytes[i],16)
print(chr((~bytes[0]) & 0x000000FF))
print(chr(bytes[1] ^ 0x75))


thus in this example
d = "9c1a"
prints out
'co'