If you have an area in memory that is xor obfuscated debug007:0018FB06 db 9Ch ; œ debug007:0018FB07 db 1Ah and you have assembly code that decodes it with a bitwise not like this .text:00401671 movzx edx, byte ptr [eax+3] .text:00401675 not cl .text:00401677 xor dl, 75h You can decode it to read it in IDA Python scripting by going to file -> script command and entering code like this where 'd' is filled with the encoded hex values and the print statements are filled with the individual xor values from the code from textwrap import wrap d = "9c1a" bytes = wrap(d, 2) for i in range(len(bytes)): bytes[i] = int(bytes[i],16) print(chr((~bytes[0]) & 0x000000FF)) print(chr(bytes[1] ^ 0x75)) thus in this example d = "9c1a" prints out 'co'
Showing posts with label not. Show all posts
Showing posts with label not. Show all posts
Friday, November 9, 2018
IDA Python bitwise NOT Decode malware strings
Subscribe to:
Posts (Atom)