o
    Žõ±jR.  ã                   @   s    d dl mZmZ d dlZd dlZd dlZdd„ Zdefdd„Zdd	e	fd
d„Z
dd„ Zdefdd„Zdefdd„Zdd„ Zdd„ Zdd„ ZedkrNeƒ  dS dS )é    )ÚAESÚ
cipherMODENc           
      C   s  g d¢}dd„ | D ƒ} dd„ |D ƒ}d}d}| | }|| }d}t dƒD ]S}|dkr0|dkr0 nH|||d> B d	A d
@ N }|}	|dkrEd}	n|dkrKd}	||	  |d
@ N  < |d7 }|d7 }|t| ƒkrfd}n| | }|t|ƒkrsd}q$|| }q$d dd„ |D ƒ¡S )N)i  i  i  i  c                 S   ó   g | ]}|‘qS © r   ©Ú.0Úxr   r   ú“/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/utils/crypto/ofcdecrypt.pyÚ
<listcomp>   ó    z(trendmicro_build_key.<locals>.<listcomp>c                 S   r   r   r   r   r   r   r	   r
      r   r   i;  é   é   i,k  iÿÿ  é   é   ó    c                 S   s   g | ]}t j|d ddd�‘qS )r   ÚlittleF©Ú	byteorderÚsigned)ÚintÚto_bytesr   r   r   r	   r
   3   s    )ÚrangeÚlenÚjoin)
Úpwd1Úpwd2ÚoÚidxaÚidxbÚaÚbr   ÚiÚtr   r   r	   Útrendmicro_build_key   s6   
r#   Úencdatac                 C   s†  d}g }t | ƒdkr¾|d7 }dgd }| d dkr| dd … } t| d ƒ}t | dd… ¡d }| dd … } tddƒ}d}t||ƒ}t|ƒD ]}|d	 }t | ||d	 … ¡}	|t||	ƒ7 }qF|d |… }| |d	 d … } tjt | d d
… ¡ddd�}
| d
d … } |d d }d}t	 	d| 
¡ d |… ¡}|D ]}||A d@ }q˜||
kr©d| }|dkr³|dd … }| |¡ t | ƒdks
d |¡S )Nr   r   i   ú!é   s   Windows7621673NTs   Virus3761267TrendÚ é   r   ÚbigFr   r   i;zbOÚIl   ÿÿ z!!!CRC MISMATCH!!!)r   r   ÚbytesÚfromhexr#   Útrendmicro_crypt1r   Útrendmicro_crypt2Ú
from_bytesÚarrayÚencodeÚappendr   )r$   ÚmultistrÚresultsÚtablexÚblocksÚblocklenÚkeyÚresr!   Ú	blockdataÚrescrcÚcrcblocklenÚcrcr   Úcr   r   r	   Útrendmicro_crypt5   sB   



Þ
#r?   FÚencdecc                 C   s¦  d}d}d}d}d}dgd }dgd }	dgd	 }
t d
ƒD ]}|||d   ||d d  @ r1dnd||< qt dƒD ]´}|d	d
… }
|du rI|}nd| }t dƒD ]}|d	||   | |d |  A |	|< qQt dƒD ]d}|d }|	| d> |	|d  d> B |	|d  d> B |	|d  d> B |	|d  B |	|d  d> B }||d> |  }|d> }|d? d@ |d
| < |d? d@ |d| < |d? d@ |d| < |d@ |d| < qjt d	ƒD ]}|| |d
||   A |d	| < qÓ|
|d	d …  }q:|d	d
… }
|d d	… |d d	…  |d
d …  }|
|d	d …  }dd„ |D ƒ}d}t dƒD ]*}d||< d}|dk�rE|||  �r8||  |O  < |d7 }|d }|dk�s)�qd dd„ |D ƒ¡}|S )Ns€              €€€€€€€ €   @@@@@@@ @s0    	
 s   
	  
		
 	
 	 
 
	 
	
 	
 	 	
	 

 	 	
 
	
	  
	
 	 
	
	  	

	 
	 	 
	
  	
 	

 	
	 
	 
 		 

	 s     	
s@   '/7?&.6>%-5=$,4<#+3;"*
2:!)	19  (08r   é`   é0   é    é@   r   r   r(   Té   r   é   é   r&   r   éA   éB   éC   c                 S   r   r   r   r   r   r   r	   r
   ¹   r   z%trendmicro_crypt2.<locals>.<listcomp>é€   r'   c                 s   s   � | ]}t |ƒV  qd S )N)Úchrr   r   r   r	   Ú	<genexpr>Ä   s   € z$trendmicro_crypt2.<locals>.<genexpr>)r   r   )r5   r:   r@   Útable1Útable2Útable3Útable4Útable5ÚtmpÚtmp2Úbckr!   r"   Újr>   Útdatar   r   r	   r.   ]   s\    


.&X"$

ü€r.   c                 C   sâ   d}d}d}dgd }t dƒD ]}|||d   }||d d  }||@ }	|	r)dnd||< qd}
t dƒD ]:}|
|| 7 }
t d	ƒD ]-}|| }|d
k rMd}nd
}|d
8 }||
7 }|d
kr_|d
8 }||7 }|| | |d	 | < q@q4| S )Nsp      @@@@@@@ @           s   s0   
 	(3$.6'2, /+0&7!4-)1#r   é8   r   r   r(   rB   é   )r   )r5   r8   rN   rO   rP   rS   r!   ÚklÚtlÚktr>   rV   r"   Úrr   r   r	   r-   È   s2   
õr-   c                 C   sF   d}d}t |tj|ƒ t | ¡¡}|d |d  … }|dd …  d¡S )Ns    ëéÇll‰p=ürSÿÝq­¿ô¢ç ‰ü|¦ÊKss   i.ü9‰Jº›bÎfÉ®éÿÿÿÿr&   zutf-8)r   r   ÚCBCÚdecryptr+   r,   Údecode)r$   r8   ÚivÚdecr   r   r	   Útrendmicro_cryptexî   s
   rd   c                 C   sp   |   d¡du rt| dd … ƒS |   d¡du rt| dd … ƒS |   d¡du r-t| dd … ƒS |   d¡du r6d	S d S )
Nz!CRYPT!Té   ú	!CRYPTEX!é	   z
!CRYPTEX3!é
   z	!CRYPTNG!z#Decrypting CRYPTNG is not supported)Ú
startswithr?   rd   )r$   r   r   r	   Útrendmicro_decryptù   s   ÿrj   c                 C   sˆ   t  d¡}g }t| ddd��,}|D ]}| ¡ }|dkrq| |¡}|r0| | d¡| d¡f¡ q|W  d   ƒ S 1 s=w   Y  d S )Nz=^([^=]+?)=\s*((!CRYPTEX!|!CRYPT!|!CRYPTEX3!|!CRYPTNG!)[^=]+)$r]   zlatin-1)Úencodingr'   r   r   )ÚreÚcompileÚopenÚstripÚmatchr2   Úgroup)ÚfilepathÚpatternÚresultÚfÚlinerp   r   r   r	   Úparse_ofscan_ini_file  s   

€$ørw   c                 C   s¶   t j | ¡rt| ƒ}nd| g}g }|D ]E}z"t|d ƒ}|d u r"W q| d¡du r-t|ƒ}| |d |f¡ W q tyX } z| |d d|d |f f¡ W Y d }~qd }~ww |S )NzRESULT:r   rf   Tr   z Failed to decrypt: %s Reason: %s)ÚosÚpathÚisfilerw   rj   ri   r2   Ú	Exception)Úfilepath_or_dataÚlinesr4   rv   ÚdecdataÚer   r   r	   Úofscan_decrypt_data  s"   
*€ÿr€   c                  C   sZ   dd l } | jdd�}|jddd� | ¡ }t|jƒ}|D ]}td|d |d f ƒ qd S )	Nr   z"Decrypt TrendMicro ofscan.ini file)Údescriptionrr   zPofscan.ini file path or string beginning with !CRYPT! or !CRYPTEX! or !CRYPTEX3!)Úhelpz%s: %sr   )ÚargparseÚArgumentParserÚadd_argumentÚ
parse_argsr€   rr   Úprint)rƒ   ÚparserÚargsr4   rt   r   r   r	   Úmain#  s   
ÿrŠ   Ú__main__)F)Úunicrypto.symmetricr   r   r0   rx   rl   r#   Ústrr?   Úboolr.   r-   rd   rj   rw   r€   rŠ   Ú__name__r   r   r   r	   Ú<module>   s    $(k&


ÿ