o
    jR.                     @   s   d dl mZmZ d dlZd dlZd dlZdd ZdefddZdd	e	fd
dZ
dd ZdefddZdefddZdd Zdd Zdd ZedkrNe  dS dS )    )AES
cipherMODENc           
      C   s  g d}dd | D } dd |D }d}d}| | }|| }d}t dD ]S}|dkr0|dkr0 nH|||d> B d	A d
@ N }|}	|dkrEd}	n|dkrKd}	||	  |d
@ N  < |d7 }|d7 }|t| krfd}n| | }|t|krsd}q$|| }q$ddd |D S )N)i  i  i  i  c                 S      g | ]}|qS  r   .0xr   r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/utils/crypto/ofcdecrypt.py
<listcomp>       z(trendmicro_build_key.<locals>.<listcomp>c                 S   r   r   r   r   r   r   r	   r
      r   r   i;        i,k  i            c                 S   s   g | ]}t j|d dddqS )r   littleF	byteordersigned)intto_bytesr   r   r   r	   r
   3   s    )rangelenjoin)
pwd1pwd2oidxaidxbabr   itr   r   r	   trendmicro_build_key   s6   
r#   encdatac                 C   s  d}g }t | dkr|d7 }dgd }| d dkr| dd  } t| d }t| dd d }| dd  } tdd}d}t||}t|D ]}|d	 }t| ||d	  }	|t||	7 }qF|d | }| |d	 d  } tjt| d d
 ddd}
| d
d  } |d d }d}t		d|
 d | }|D ]}||A d@ }q||
krd| }|dkr|dd  }|| t | dks
d|S )Nr   r   i   !   s   Windows7621673NTs   Virus3761267Trend    r   bigFr   r   i;zbOIl    z!!!CRC MISMATCH!!!)r   r   bytesfromhexr#   trendmicro_crypt1r   trendmicro_crypt2
from_bytesarrayencodeappendr   )r$   multistrresultstablexblocksblocklenkeyresr!   	blockdatarescrccrcblocklencrcr   cr   r   r	   trendmicro_crypt5   sB   




#r?   Fencdecc                 C   s  d}d}d}d}d}dgd }dgd }	dgd	 }
t d
D ]}|||d   ||d d  @ r1dnd||< qt dD ]}|d	d
 }
|du rI|}nd| }t dD ]}|d	||   | |d |  A |	|< qQt dD ]d}|d }|	| d> |	|d  d> B |	|d  d> B |	|d  d> B |	|d  B |	|d  d> B }||d> |  }|d> }|d? d@ |d
| < |d? d@ |d| < |d? d@ |d| < |d@ |d| < qjt d	D ]}|| |d
||   A |d	| < q|
|d	d   }q:|d	d
 }
|d d	 |d d	  |d
d   }|
|d	d   }dd |D }d}t dD ]*}d||< d}|dkrE|||  r8||  |O  < |d7 }|d }|dks)qddd |D }|S )Ns                  @@@@@@@ @s0    	
 s   
	  
		
 	
 	 
 
	 
	
 	
 	 	
	 

 	 	
 
	
	  
	
 	 
	
	  	

	 
	 	 
	
  	
 	

 	
	 
	 
 		 

	 s     	
s@   '/7?&.6>%-5=$,4<#+3;"*
2:!)	19  (08r   `   0       @   r   r   r(   T   r         r&   r   A   B   C   c                 S   r   r   r   r   r   r   r	   r
      r   z%trendmicro_crypt2.<locals>.<listcomp>   r'   c                 s   s    | ]}t |V  qd S )N)chrr   r   r   r	   	<genexpr>   s    z$trendmicro_crypt2.<locals>.<genexpr>)r   r   )r5   r:   r@   table1table2table3table4table5tmptmp2bckr!   r"   jr>   tdatar   r   r	   r.   ]   s\    


.&X"$

r.   c                 C   s   d}d}d}dgd }t dD ]}|||d   }||d d  }||@ }	|	r)dnd||< qd}
t dD ]:}|
|| 7 }
t d	D ]-}|| }|d
k rMd}nd
}|d
8 }||
7 }|d
kr_|d
8 }||7 }|| | |d	 | < q@q4| S )Nsp      @@@@@@@ @           s   s0   
 	(3$.6'2, /+0&7!4-)1#r   8   r   r   r(   rB      )r   )r5   r8   rN   rO   rP   rS   r!   kltlktr>   rV   r"   rr   r   r	   r-      s2   
r-   c                 C   sF   d}d}t |tj|t| }|d |d   }|dd  dS )Ns    llp=rSq砉|Kss   i.9Jbfr&   zutf-8)r   r   CBCdecryptr+   r,   decode)r$   r8   ivdecr   r   r	   trendmicro_cryptex   s
   rd   c                 C   sp   |  ddu rt| dd  S |  ddu rt| dd  S |  ddu r-t| dd  S |  ddu r6d	S d S )
Nz!CRYPT!T   	!CRYPTEX!	   z
!CRYPTEX3!
   z	!CRYPTNG!z#Decrypting CRYPTNG is not supported)
startswithr?   rd   )r$   r   r   r	   trendmicro_decrypt   s   rj   c                 C   s   t d}g }t| ddd,}|D ]}| }|dkrq||}|r0||d|df q|W  d    S 1 s=w   Y  d S )Nz=^([^=]+?)=\s*((!CRYPTEX!|!CRYPT!|!CRYPTEX3!|!CRYPTNG!)[^=]+)$r]   zlatin-1)encodingr'   r   r   )recompileopenstripmatchr2   group)filepathpatternresultflinerp   r   r   r	   parse_ofscan_ini_file  s   

$rw   c                 C   s   t j| rt| }nd| g}g }|D ]E}z"t|d }|d u r"W q|ddu r-t|}||d |f W q tyX } z||d d|d |f f W Y d }~qd }~ww |S )NzRESULT:r   rf   Tr   z Failed to decrypt: %s Reason: %s)ospathisfilerw   rj   ri   r2   	Exception)filepath_or_datalinesr4   rv   decdataer   r   r	   ofscan_decrypt_data  s"   
*r   c                  C   sZ   dd l } | jdd}|jddd | }t|j}|D ]}td|d |d f  qd S )	Nr   z"Decrypt TrendMicro ofscan.ini file)descriptionrr   zPofscan.ini file path or string beginning with !CRYPT! or !CRYPTEX! or !CRYPTEX3!)helpz%s: %sr   )argparseArgumentParseradd_argument
parse_argsr   rr   print)r   parserargsr4   rt   r   r   r	   main#  s   
r   __main__)F)unicrypto.symmetricr   r   r0   rx   rl   r#   strr?   boolr.   r-   rd   rj   rw   r   r   __name__r   r   r   r	   <module>   s    $(k&


