Init. Commit

finals/orchid-wallet-ios-reverse-medium/solve/solve.py

@@ -0,0 +1,24 @@
+#!/usr/bin/env python3
+from pathlib import Path
+import argparse, base64, hashlib, json, lzma, marshal, os, plistlib, re, struct, subprocess, sys, zipfile, zlib
+
+def xor(data, key):
+    return bytes(b ^ key[i % len(key)] for i, b in enumerate(data))
+
+def find_after(data, marker):
+    off = data.index(marker) + len(marker)
+    ln = struct.unpack_from('<I', data, off)[0]
+    off += 4
+    return data[off:off+ln]
+
+def main():
+    ap=argparse.ArgumentParser(); ap.add_argument('ipa', nargs='?', default='../public/OrchidWallet.ipa'); args=ap.parse_args()
+    with zipfile.ZipFile(args.ipa) as z:
+        bin_data=z.read('Payload/OrchidWallet.app/OrchidWallet')
+        prov=z.read('Payload/OrchidWallet.app/embedded.mobileprovision')
+    key=re.search(rb'KeyHint=([a-z\-]+)', prov).group(1)
+    off=bin_data.index(b'ORCHIDCFG')+len(b'ORCHIDCFG')
+    ln=struct.unpack_from('<I', bin_data, off)[0]; off += 4
+    cfg=json.loads(xor(bin_data[off:off+ln], key))
+    print(cfg['flag'])
+if __name__=='__main__': main()