etc

~ scripts and random things
git clone https://github.com/djnnvx/etc.git
decrypt_xor_dump.py (1094B)
      1 """
      2 
      3     Author: vari.sh
      4 
      5     Description: This program is an utility to locally decrypt lsass.dmp files created with Doppelganger
      6 
      7 """
      8 
      9 import sys
     10 
     11 # XOR key used during encryption
     12 XOR_KEY = b"0123456789abcdefghij"
     13 
     14 def xor_decrypt(data: bytes, key: bytes) -> bytes:
     15     return bytes([b ^ key[i % len(key)] for i, b in enumerate(data)])
     16 
     17 def main():
     18     if len(sys.argv) != 2:
     19         print(f"Usage: {sys.argv[0]} <xor_dump_path>")
     20         sys.exit(1)
     21 
     22     encrypted_path = sys.argv[1]
     23     output_path = encrypted_path + ".dec"
     24 
     25     try:
     26         with open(encrypted_path, "rb") as f:
     27             data = f.read()
     28     except IOError as e:
     29         print(f"[!] Failed to read file: {e}")
     30         sys.exit(1)
     31 
     32     decrypted = xor_decrypt(data, XOR_KEY)
     33 
     34     try:
     35         with open(output_path, "wb") as f:
     36             f.write(decrypted)
     37     except IOError as e:
     38         print(f"[!] Failed to write decrypted file: {e}")
     39         sys.exit(1)
     40 
     41     print(f"[+] Decryption successful. Output written to: {output_path}")
     42 
     43 if __name__ == "__main__":
     44     main()