Script to decrypt the FlyStudio malware sample show in the Youtube video
# # Script to decrypt the malware sample with the # MD5 hash 09002944F0F0EEC37B022507919C3538, used # in the video at the following URL: # # https://www.youtube.com/watch?v=bEsQ8UYioU4 # oep = 0x401000 start_ea = idc.get_segm_start(oep) end_ea = idc.get_segm_end(oep) KEY = 0x33847E02 for addr in range(start_ea, end_ea, 4): dw_val = get_wide_dword(addr) dw_val -= KEY dw_val = dw_val & 0xFFFFFFFF patch_dword(addr, dw_val)
Comments
0 B
|👍
/👎
0 B
|👍
/👎
0 B
|👍
/👎
0 B
|👍
/👎