29 lines
1.3 KiB
Python
29 lines
1.3 KiB
Python
#!/usr/bin/env python3
|
|
from pathlib import Path
|
|
import argparse, base64, hashlib, json, lzma, marshal, os, plistlib, re, struct, subprocess, sys, zipfile, zlib
|
|
|
|
def xor(data, key):
|
|
return bytes(b ^ key[i % len(key)] for i, b in enumerate(data))
|
|
|
|
def find_after(data, marker):
|
|
off = data.index(marker) + len(marker)
|
|
ln = struct.unpack_from('<I', data, off)[0]
|
|
off += 4
|
|
return data[off:off+ln]
|
|
|
|
def utf16_strings(data):
|
|
vals = []
|
|
for m in re.finditer(rb'(?:[ -~]\x00){8,}', data):
|
|
vals.append(m.group(0).decode('utf-16le'))
|
|
return vals
|
|
def main():
|
|
ap = argparse.ArgumentParser(); ap.add_argument('dll', nargs='?', default='../public/ChameleonLine.dll')
|
|
args = ap.parse_args(); data = Path(args.dll).read_bytes(); vals = utf16_strings(data)
|
|
enc = next(v[6:] for v in vals if v.startswith('CFGv2:'))
|
|
key = next(v for v in vals if re.fullmatch(r'[0-9a-f]{32}', v) and v.startswith('0011'))
|
|
iv = next(v for v in vals if re.fullmatch(r'[0-9a-f]{32}', v) and v.startswith('1021'))
|
|
p = subprocess.run(['openssl','enc','-d','-aes-128-cbc','-K',key,'-iv',iv,'-nosalt','-A','-base64'],
|
|
input=enc, text=True, stdout=subprocess.PIPE, check=True)
|
|
print(json.loads(p.stdout)['export'])
|
|
if __name__ == '__main__': main()
|