Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

data/ioc/spyware/amnesty/2020-09-25_finfisher/scripts/cobaltstrike/cobaltstrike_config.py

@@ -0,0 +1,115 @@
+import argparse
+import struct
+import re
+import sys
+import json
+
+"""
+Extract configuration from a Cobalt Strike decrypted beacon
+
+Author : Etienne Maynier, Amnesty Tech
+Date : March 2020
+"""
+
+CONFIG_STRUCT = {
+    1: "dns_ssl",
+    2: "port",
+    3: ".sleeptime",
+    4: ".http-get.server.output",
+    5: ".jitter",
+    6: ".maxdns",
+    7: "publickey",
+    8: ".http-get.uri",
+    9: ".user-agent",
+    10: ".http-post.uri",
+    11: ".http-get.server.output",
+    12: ".http-get.client",
+    13: ".http-post.client",
+    14: ".spawnto",
+    15: "unknown",
+    19: ".dns_idle",
+    20: ".dns_sleep ",
+    26: ".http-get.verb",
+    27: ".http-post.verb",
+    28: "shouldChunkPosts",
+    29: ".post-ex.spawnto_x86",
+    30: ".post-ex.spawnto_x64",
+    31: "cryptoscheme",
+    37: "watermark",
+    38: ".stage.cleanup",
+    39: "CFGCaution",
+    50: "cookieBeacon"
+}
+CONFIG_SIZE = 1978
+
+class JsonEncoder(json.JSONEncoder):
+    def default(self, obj):
+        if isinstance(obj, bytearray):
+             return obj.hex()
+        return json.JSONEncoder.default(self, obj)
+
+
+def search_config(data):
+    r = re.search(b"ihihik.{2}ikihik", data)
+    if r:
+        return r.span()[0]
+    else:
+        return None
+
+
+def decode_config(data):
+    config = {}
+    i = 0
+    while i < len(data) - 8:
+        dec = struct.unpack(">HHH", data[i:i+6])
+        if dec[0] == 1:
+            v = struct.unpack(">H", data[i+6:i+8])[0]
+            config["dns"] = ((v & 1) == 1)
+            config["ssl"] = ((v & 8) == 8)
+        elif dec[0] in CONFIG_STRUCT.keys():
+            if dec[1] == 1 and dec[2] == 2:
+                # Short
+                config[CONFIG_STRUCT[dec[0]]] = struct.unpack(">H", data[i+6:i+8])[0]
+            elif dec[1] == 2 and dec[2] == 4:
+                # Int
+                config[CONFIG_STRUCT[dec[0]]] = struct.unpack(">I", data[i+6:i+10])[0]
+            elif dec[1] == 3:
+                # Byte or string
+                v = data[i+6:i+6+dec[2]]
+                try:
+                    config[CONFIG_STRUCT[dec[0]]] = v.decode('utf-8').strip('\x00')
+                except UnicodeDecodeError:
+                    config[CONFIG_STRUCT[dec[0]]] = v
+        else:
+            print("Unknown config command {}".format(dec[0]))
+        # Add size +
+        i += dec[2] + 6
+    return config
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description='Extract Cobalt Strike configuration')
+    parser.add_argument('PAYLOAD', help='A Cobalt Strike beacon')
+    parser.add_argument('--json', '-j', action="store_true", help='Print json')
+    args = parser.parse_args()
+
+    with open(args.PAYLOAD, "rb") as f:
+        data = f.read()
+
+    START = search_config(data)
+    if not START:
+        print("Start position of the config struct not found")
+        sys.exit(-1)
+
+    # Configuration is xored with 105
+    conf = bytearray([c ^ 105 for c in data[START:START+CONFIG_SIZE]])
+
+    config = decode_config(conf)
+    if args.json:
+        print(json.dumps(config, indent=4, sort_keys=True, cls=JsonEncoder))
+    else:
+        for d in config:
+            if isinstance(config[d], bytearray):
+                print("{} : {}".format(d, config[d].hex()))
+            else:
+                print("{} : {}".format(d, config[d]))

data/ioc/spyware/amnesty/2020-09-25_finfisher/scripts/cobaltstrike/cobaltstrike_decode.py

@@ -0,0 +1,51 @@
+import argparse
+import struct
+import sys
+
+"""
+Decrypt a Cobalt Strike encrypted beacon
+
+Author: Etienne Maynier, Amnesty Tech
+Date: March 2020
+"""
+
+def xor(a, b):
+    return bytearray([a[0]^b[0], a[1]^b[1], a[2]^b[2], a[3]^b[3]])
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description='Decode an encoded Cobalt Strike beacon')
+    parser.add_argument('PAYLOAD', help='an integer for the accumulator')
+    args = parser.parse_args()
+
+    with open(args.PAYLOAD, "rb") as f:
+        data = f.read()
+
+    # The base address of the sample change depending on the code
+    ba = data.find(b"\xe8\xd4\xff\xff\xff")
+    if ba == -1:
+        ba = data.find(b"\xe8\xd0\xff\xff\xff")
+        if ba == -1:
+            print("Base Address not found")
+            sys.exit(1)
+    ba += 5
+
+    key = data[ba:ba+4]
+    print("Key : {}".format(key))
+    size = struct.unpack("I", xor(key, data[ba+4:ba+8]))[0]
+    print("Size : {}".format(size))
+
+    res = bytearray()
+    i = ba+8
+    while i < (len(data) - ba - 8):
+        d = data[i:i+4]
+        res += xor(d, key)
+        key = d
+        i += 4
+
+    if not res.startswith(b"MZ"):
+        print("Invalid decoding, no PE header")
+
+    with open("a.out", "wb+") as f:
+        f.write(res)
+    print("PE file extracted in a.out")

data/ioc/spyware/amnesty/2020-09-25_finfisher/scripts/decode_modules.py

@@ -0,0 +1,56 @@
+import sys
+import os
+import struct
+import hashlib
+import ctypes
+import binascii
+import argparse
+from Crypto.Cipher import AES
+"""
+Decode FinSpy modules for Linux and MacOS
+
+Author : Maciek mak@malwarelab.pl
+Date: August 2020
+"""
+
+
+def unpack(data, s=0):
+    """
+    Decode the binary with aplib
+    """
+    cin = ctypes.c_buffer(data)
+    cout = ctypes.c_buffer(s if s else len(data) * 20)
+    aplib_path = os.path.join(
+            os.path.dirname(os.path.realpath(__file__)),
+            "_aplib.so")
+    aPLIB = ctypes.cdll.LoadLibrary(aplib_path)
+    n = aPLIB.aP_depack(cin, cout)
+    return cout.raw[:n]
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description='Unpack FinSpy modules')
+    parser.add_argument('MODULE', help='Finspy module')
+    args = parser.parse_args()
+
+    with open(args.MODULE,'rb') as f:
+        hmd5 = f.read(0x10)
+        IV = f.read(0x10)
+        data = f.read()
+
+    hash_iv_data = hashlib.md5(IV + data)
+    if hmd5 == hash_iv_data.digest():
+        data = IV + data
+        IV = b'\xd9!V\xee\xbe\x0c\xf9\x18*\xfaR;%&\xb7\x08'
+
+    if hmd5 == hashlib.md5(data).digest():
+        print('[+] DATA HASH match {}'.format(binascii.hexlify(hmd5)))
+
+    key = b'YO\xf4\xa6\xd6\x1d\xd7!\xdc\x01A\xbfg\x83"m'
+    xdata = AES.new(key,mode=AES.MODE_CBC,IV=bytes(IV)).decrypt(data)
+    size = struct.unpack('I',xdata[:4])[0]
+    print('[+] Unpacked size: {:x}'.format(size))
+    depack = unpack(xdata[4:], size)
+    with open(args.MODULE + '.unpacked.bin','wb') as f:
+        f.write(depack)
+    print('[*] saved to {}.unpacked.bin'.format(sys.argv[1]))

data/ioc/spyware/amnesty/2020-09-25_finfisher/scripts/linux/extract_config.py

@@ -0,0 +1,38 @@
+import os
+import sys
+import argparse
+import re
+import struct
+
+"""
+Extract configuration of Linux FinSpy from an installer
+author: Etienne Maynier, Amnesty Tech
+"""
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description='Extract configuration Linux Finspy sample')
+    parser.add_argument('FILE', help='FinSpy sample for Linux')
+    args = parser.parse_args()
+
+    regex_cfg = re.compile(b'.[\x50-\x5f]\xa5\xaa\xca\xa6\x54\x5a.[\xa0-\xaf]\x5a\xa5\x0a')
+
+    with open(args.FILE, 'rb') as f:
+        data = f.read()
+
+    if len(regex_cfg.findall(data)) < 5:
+        print("This does not look like a FinSpy sample")
+        sys.exit(-1)
+
+    if not os.path.isdir('extracted'):
+        os.mkdir('extracted')
+
+    i = 1
+    for cfg in regex_cfg.finditer(data):
+        pos = cfg.span()[0]
+        # Decrypt the first 4 bytes to get the length
+        length = struct.unpack('I', bytearray([data[pos]^0xaa, data[pos+1]^0x5a, data[pos+2]^0xa5, data[pos+3]^0xaa]))[0]
+        with open('extracted/{0:02d}.dat'.format(i), 'wb+') as f:
+            f.write(data[pos:pos+length])
+        print("Configuration file extracted {0:02d}.dat ({} bytes)".format(i, length))
+        i += 1

data/ioc/spyware/amnesty/2020-09-25_finfisher/scripts/read_config.py

@@ -0,0 +1,872 @@
+import argparse
+import os
+import sys
+import struct
+#import simplejson as json
+from json import JSONEncoder
+import json
+from io import BytesIO
+"""
+Decode configuration from FinSpy Linux, MacOS and Android samples
+Python3 only
+"""
+
+__author__      = "Maciek mak@malwarelab.pl"
+
+
+# From https://github.com/devio/FinSpy-Tools/blob/master/Android/finspyCfgParse.py
+tlv_types = {
+    4522400: "TlvTypeMobileTrackingStartRequest",
+    4522656: "TlvTypeMobileTrackingStopRequest",
+    4523376: "TlvTypeMobileTrackingDataV10",
+    4535200: "TlvTypeMobileTrackingConfig",
+    4535440: "TlvTypeMobileTrackingConfigRaw",
+    4538432: "TlvTypeMobileTrackingTimeInterval",
+    4538688: "TlvTypeMobileTrackingDistance",
+    4538928: "TlvTypeMobileTrackingSendOnAnyChannel",
+    6291872: "TlvTypeMobileLoggingMetaInfo",
+    6292096: "TlvTypeMobileLoggingData",
+    4456864: "TlvTypeMobileBlackberryMessengerMetaInfo",
+    4457088: "TlvTypeMobileBlackberryMessengerData",
+    4457328: "TlvTypeMobileBlackberryMsChatID",
+    4457600: "TlvTypeMobileBlackberryMsConversationPartners",
+    4587936: "TlvTypeMobilePhoneCallLogsMetaInfo",
+    4588192: "TlvTypeMobilePhoneCallLogsData",
+    4588400: "TlvTypeMobilePhoneCallLogsType",
+    4588672: "TlvTypeMobilePhoneCallAdditionalInformation",
+    4588912: "TlvTypeMobilePhoneCallLogsCallerNumber",
+    4589168: "TlvTypeMobilePhoneCallLogsCalleeNumber",
+    4589440: "TlvTypeMobilePhoneCallLogsCallerName",
+    4589696: "TlvTypeMobilePhoneCallLogsCalleeName",
+    4591680: "TlvTypeMobilePhoneCallLogLastEntryEndtime",
+    4325792: "TlvTypeMobileSMSMetaInfo",
+    4326016: "TlvTypeMobileSMSData",
+    4326256: "TlvTypeSMSSenderNumber",
+    4326512: "TlvTypeSMSRecipientNumber",
+    4326768: "TlvTypeSMSDirection",
+    4326528: "TlvTypeSMSInformation",
+    4391328: "TlvTypeMobileAddressBookMetaInfo",
+    4391552: "TlvTypeMobileAddressBookData",
+    4407360: "TlvTypeMobileAddressBookChecksum",
+    8978752: "TlvTypeMobileProxyMasterCommSig",
+    8979104: "TlvTypeMobileProxyMasterComm",
+    8979360: "TlvTypeMobileMasterProxyComm",
+    8979616: "TlvTypeProxyMasterMobileHeartBeatAnswer",
+    8979872: "TlvTypeMobileMasterProxyCommNotification",
+    8782176: "TlvTypeProxyMobileTargetCommSig",
+    8782496: "TlvTypeProxyMobileTargetComm",
+    8782752: "TlvTypeProxyMasterMobileTargetComm",
+    1507744: "TlvTypeAccessedFileMetaInfo",
+    1507968: "TlvTypeAccessedFileAccessTime",
+    1508224: "TlvTypeAccessedFileAccessEvent",
+    1508496: "TlvTypeAccessedFileRecording",
+    1508736: "TlvTypeAccessedApplicationName",
+    1508912: "TlvTypeConfigRecordImagesFromExplorer",
+    1519776: "TlvTypeGetAccessedConfigRequest",
+    1520032: "TlvTypeAccessedConfigReply",
+    1520288: "TlvTypeSetAccessedConfigRequest",
+    1520448: "TlvTypeConfigAccessedEvents",
+    2240672: "TlvTypeGetMouseClicksConfigRequest",
+    2240928: "TlvTypeMouseClicksConfigReply",
+    2241184: "TlvTypeSetMouseClicksConfigRequest",
+    2228640: "TlvTypeMouseClicksMetaInfo",
+    2228896: "TlvTypeMouseClicksFrame",
+    2232448: "TlvTypeMouseClicksEncodingType",
+    2232896: "TlvTypeConfigMouseClicksRectangle",
+    2233152: "TlvTypeConfigMouseClicksSensitivity",
+    2233408: "TlvTypeConfigMouseClicksType",
+    2175136: "TlvTypeGetVoIPConfigRequest",
+    2175392: "TlvTypeVoIPConfigReply",
+    2175648: "TlvTypeSetVoIPConfigRequest",
+    2163104: "TlvTypeVoIPMetaInfo",
+    2166912: "TlvTypeVoIPEncodingType",
+    2167168: "TlvTypeVoIPSessionType",
+    2167424: "TlvTypeVoIPApplicationName",
+    2167696: "TlvTypeVoIPAppScreenshot",
+    2167952: "TlvTypeVoIPAudioRecording",
+    2168112: "TlvTypeConfigVoIPScreenshotEnabled",
+    2109600: "TlvTypeGetForensicsConfigRequest",
+    2109856: "TlvTypeForensicsConfigReply",
+    2110112: "TlvTypeSetForensicsConfigRequest",
+    2097568: "TlvTypeUploadForensicsApplicationRequest",
+    2097824: "TlvTypeUploadForensicsApplicationReply",
+    2098080: "TlvTypeUploadForensicsApplicationChunk",
+    2098336: "TlvTypeUploadForensicsApplicationDoneRequest",
+    2098592: "TlvTypeUploadForensicsApplicationDoneReply",
+    2101664: "TlvTypeRemoveForensicsApplicationRequest",
+    2101920: "TlvTypeRemoveForensicsApplicationReply",
+    2105760: "TlvTypeForensicsAppExecuteRequest",
+    2106016: "TlvTypeForensicsAppExecuteReply",
+    2106272: "TlvTypeForensicsAppExecuteResult",
+    2106528: "TlvTypeForensicsAppExecuteResultChunk",
+    2106784: "TlvTypeForensicsAppExecuteResultDone",
+    2107040: "TlvTypeForensicsCancelAppExecuteRequest",
+    2107296: "TlvTypeForensicsCancelAppExecuteReply",
+    2113680: "TlvTypeConfigForensicsApplicationInfoGeneric",
+    2113952: "TlvTypeConfigForensicsApplicationInfo",
+    2117760: "TlvTypeConfigForensicsApplicationName",
+    2117952: "TlvTypeConfigForensicsApplicationSize",
+    2118208: "TlvTypeConfigForensicsApplicationID",
+    2118528: "TlvTypeConfigForensicsApplicationCmdline",
+    2118784: "TlvTypeConfigForensicsApplicationOutput",
+    2118976: "TlvTypeConfigForensicsApplicationTimeout",
+    2119232: "TlvTypeConfigForensicsApplicationVersion",
+    2119552: "TlvTypeForensicsFriendlyName",
+    2119808: "TlvTypeConfigForensicsApplicationOutputPrepend",
+    2120064: "TlvTypeConfigForensicsApplicationOutputContentType",
+    1638816: "TlvTypeDeletedFileMetaInfo",
+    1639296: "TlvTypeDeletedFileDeletionTime",
+    1639552: "TlvTypeDeletedFileRecycleBin",
+    1639808: "TlvTypeDeletedMethod",
+    1640064: "TlvTypeDeletedApplicationName",
+    1640336: "TlvTypeDeletedFileRecording",
+    1650848: "TlvTypeGetDeletedConfigRequest",
+    1651104: "TlvTypeDeletedConfigReply",
+    1651360: "TlvTypeSetDeletedConfigRequest",
+    1573280: "TlvTypePrintFileMetaInfo",
+    1573520: "TlvTypePrintFrame",
+    1581184: "TlvTypePrintApplicationName",
+    1581440: "TlvTypePrintFilename",
+    1581696: "TlvTypePrintEncodingType",
+    1585312: "TlvTypeGetPrintConfigRequest",
+    1585568: "TlvTypePrintConfigReply",
+    1585824: "TlvTypeSetPrintConfigRequest",
+    1442208: "TlvTypeChangedFileMetaInfo",
+    1442432: "TlvTypeChangedFileChangeTime",
+    1442688: "TlvTypeChangedFileChangeEvent",
+    1442960: "TlvTypeChangedFileRecording",
+    1454240: "TlvTypeGetChangedConfigRequest",
+    1454496: "TlvTypeChangedConfigReply",
+    1454752: "TlvTypeSetChangedConfigRequest",
+    1454912: "TlvTypeConfigChangedEvents",
+    1311136: "TlvTypeSkypeAudioMetaInfo",
+    1311376: "TlvTypeSkypeAudioRecording",
+    1311648: "TlvTypeSkypeTextRecording",
+    1311904: "TlvTypeSkypeFileMetaInfo",
+    1312144: "TlvTypeSkypeFileRecording",
+    1312416: "TlvTypeSkypeContactsRecording",
+    1312640: "TlvTypeSkypeContactsUserData",
+    1323168: "TlvTypeGetSkypeConfigRequest",
+    1323424: "TlvTypeSkypeConfigReply",
+    1323680: "TlvTypeSetSkypeConfigRequest",
+    1324336: "TlvTypeConfigSkypeAudioEnable",
+    1324592: "TlvTypeConfigSkypeTextEnable",
+    1324848: "TlvTypeConfigSkypeFileEnable",
+    1325104: "TlvTypeConfigSkypeContactsListEnable",
+    1327232: "TlvTypeSkypeAudioEncodingType",
+    1327488: "TlvTypeSkypeLoggedInUserAccountName",
+    1327744: "TlvTypeSkypeConversationPartnerAccountName",
+    1328000: "TlvTypeSkypeConversationPartnerDisplayName",
+    1328256: "TlvTypeSkypeChatMembers",
+    1328512: "TlvTypeSkypeTextMessage",
+    1328768: "TlvTypeSkypeChatID",
+    1329024: "TlvTypeSkypeSenderAccountName",
+    1329280: "TlvTypeSkypeSenderDisplayName",
+    1329536: "TlvTypeSkypeIncoming",
+    1329792: "TlvTypeSkypeSessionType",
+    1192096: "TlvTypeGetKeyloggerConfigRequest",
+    1192352: "TlvTypeKeyloggerConfigReply",
+    1192608: "TlvTypeSetKeyloggerConfigRequest",
+    1180064: "TlvTypeStartKeyLoggingRequest",
+    1180320: "TlvTypeStartKeyLoggingReply",
+    1180576: "TlvTypeKeyLoggingFrame",
+    1180832: "TlvTypeStopKeyLoggingRequest",
+    1181088: "TlvTypeKeyLoggingStoppedReply",
+    1196416: "TlvTypeKLFrameData",
+    1126560: "TlvTypeGetVideoConfigRequest",
+    1126816: "TlvTypeVideoConfigReply",
+    1127072: "TlvTypeSetVideoConfigRequest",
+    1114528: "TlvTypeStartScreenRequest",
+    1114784: "TlvTypeStartScreenReply",
+    1115040: "TlvTypeScreenFrame",
+    1115296: "TlvTypeStopScreenRequest",
+    1115552: "TlvTypeScreenStoppedReply",
+    1115808: "TlvTypeStartScreenRecording",
+    1122720: "TlvTypeStartWebCamRequest",
+    1122976: "TlvTypeStartWebCamReply",
+    1123232: "TlvTypeWebCamFrame",
+    1123488: "TlvTypeStopWebCamRequest",
+    1123744: "TlvTypeWebCamStoppedReply",
+    1124000: "TlvTypeStartWebCamRecording",
+    1130560: "TlvTypeVDFrameID",
+    1130896: "TlvTypeVDFrameData",
+    1131136: "TlvTypeOriginalVideoResolution",
+    1131392: "TlvTypeVideoResolution",
+    1066112: "TlvTypeVideoSessionType",
+    1066368: "TlvTypeVideoEncodingType",
+    1132160: "TlvTypeAutomaticRecordingUID",
+    1061024: "TlvTypeGetAudioConfigRequest",
+    1061280: "TlvTypeAudioConfigReply",
+    1061536: "TlvTypeSetAudioConfigRequest",
+    1048992: "TlvTypeStartMicrophoneRequest",
+    1049248: "TlvTypeStartMicrophoneReply",
+    1049504: "TlvTypeMicrophoneFrame",
+    1049760: "TlvTypeStopMicrophoneRequest",
+    1050016: "TlvTypeMicrophoneStoppedReply",
+    1050272: "TlvTypeStartMicrophoneRecording",
+    1052736: "TlvTypeMICFrameID",
+    1053072: "TlvTypeMICFrameData",
+    1053312: "TlvTypeAudioSessionType",
+    1053568: "TlvTypeAudioEncodingType",
+    328096: "TlvTypeGetSchedulerConfigRequest",
+    328352: "TlvTypeSchedulerConfigReply",
+    328608: "TlvTypeSetSchedulerConfigRequest",
+    331920: "TlvTypeSchedulerTask",
+    332192: "TlvTypeSchedulerTaskRecordByTime",
+    332448: "TlvTypeSchedulerTaskRecordScreenWhenAppRuns",
+    332704: "TlvTypeSchedulerTaskRecordMicWhenAppUsesIt",
+    332960: "TlvTypeSchedulerTaskRecordWebCamWhenAppUsesIt",
+    360592: "TlvTypeSCHTaskConfiguration",
+    360752: "TlvTypeSCHTaskEnabled",
+    361344: "TlvTypeSCHTaskStartDateTime",
+    361600: "TlvTypeSCHTaskStopDateTime",
+    362112: "TlvTypeSCHApplicationName",
+    362288: "TlvTypeSCHApplicationWindowOnly",
+    299168: "TlvTypeGetCmdLineConfigRequest",
+    299424: "TlvTypeCmdLineConfigReply",
+    299680: "TlvTypeSetCmdLineConfigRequest",
+    262560: "TlvTypeStartCmdLineSessionRequest",
+    262816: "TlvTypeStartCmdLineSessionReply",
+    263072: "TlvTypeStopCmdLineSessionRequest",
+    263328: "TlvTypeCmdLineSessionStoppedReply",
+    263584: "TlvTypeCmdLineExecute",
+    263840: "TlvTypeCmdLineExecutionResult",
+    266352: "TlvTypeCmdLineExecuteCommand",
+    266560: "TlvTypeCmdLineExecuteAnswerID",
+    266864: "TlvTypeCmdLineExecuteAnswerData",
+    168096: "TlvTypeGetFileSystemConfigRequest",
+    168352: "TlvTypeFileSystemConfigReply",
+    168608: "TlvTypeSetFileSystemConfigRequest",
+    131488: "TlvTypeGetAllDrivesRequest",
+    131744: "TlvTypeGetAllDrivesReply",
+    135328: "TlvTypeGetFolderContentsRequest",
+    135584: "TlvTypeGetFolderContentsReply",
+    135840: "TlvTypeGetFolderContentsNext",
+    136096: "TlvTypeGetFolderContentsEnd",
+    139424: "TlvTypeDownloadFileRequest",
+    139680: "TlvTypeCancelDownloadFileRequest",
+    139936: "TlvTypeDownloadFileReply",
+    140192: "TlvTypeDownloadFileNext",
+    140448: "TlvTypeDownloadFileEnd",
+    140704: "TlvTypeCancelDownloadFileReply",
+    143520: "TlvTypeUploadFileRequest",
+    143776: "TlvTypeCancelUploadFileRequest",
+    144032: "TlvTypeUploadFileReply",
+    144288: "TlvTypeUploadFileNext",
+    144544: "TlvTypeUploadFileEnd",
+    144800: "TlvTypeUploadFileCompleted",
+    145056: "TlvTypeCancelUploadFileReply",
+    147616: "TlvTypeDeleteFileRequest",
+    147872: "TlvTypeDeleteFileReply",
+    151968: "TlvTypeSearchFileRequest",
+    152224: "TlvTypeSearchFileReply",
+    152480: "TlvTypeSearchFileNext",
+    152736: "TlvTypeSearchFileEnd",
+    152992: "TlvTypeCancelSearchFileRequest",
+    153248: "TlvTypeCancelSearchFileReply",
+    159888: "TlvTypeFSFileDataChunk",
+    160128: "TlvTypeFSDiskDrive",
+    160384: "TlvTypeFSFullPath",
+    160640: "TlvTypeFSFilename",
+    160896: "TlvTypeFSFileExtension",
+    161088: "TlvTypeFSDiskDriveType",
+    161408: "TlvTypeFSFileSize",
+    161584: "TlvTypeFSIsFolder",
+    161840: "TlvTypeFSReadOnly",
+    162096: "TlvTypeFSHidden",
+    162352: "TlvTypeFSSystem",
+    162688: "TlvTypeFSFileCreationTime",
+    162944: "TlvTypeFSFileLastAccessTime",
+    163200: "TlvTypeFSFileLastWriteTime",
+    163472: "TlvTypeFSFullPathM",
+    8978848: "TlvTypeMasterMobileTargetConn",
+    7471520: "TlvTypeMasterTargetConn",
+    7405984: "TlvTypeMasterAgentLogin",
+    7406240: "TlvTypeMasterAgentLoginAnswer",
+    7406752: "TlvTypeMasterAgentTargetList",
+    7407008: "TlvTypeMasterAgentTargetOnlineList",
+    7407264: "TlvTypeMasterAgentTargetInfoReply",
+    7407520: "TlvTypeMasterAgentUserList",
+    7407776: "TlvTypeMasterAgentUserListReply",
+    7408032: "TlvTypeMasterAgentTargetArchivedList",
+    7408288: "TlvTypeMasterAgentTargetListEx",
+    7408544: "TlvTypeMasterAgentTargetOnlineListEx",
+    7408800: "TlvTypeMasterAgentMobileTargetArchivedList",
+    7409056: "TlvTypeMasterAgentMobileTargetList",
+    7409312: "TlvTypeMasterAgentMobileTargetOnlineList",
+    7409824: "TlvTypeMasterAgentQueryFirst",
+    7410080: "TlvTypeMasterAgentQueryNext",
+    7410336: "TlvTypeMasterAgentQueryLast",
+    7410592: "TlvTypeMasterAgentQueryAnswer",
+    7410848: "TlvTypeMasterAgentRemoveRecord",
+    7411104: "TlvTypeMasterAgentTargetInfoExReply",
+    7411344: "TlvTypeTargetInfoExProperty",
+    7411616: "TlvTypeTargetInfoExPropertyValue",
+    7411840: "TlvTypeTargetInfoExPropertyValueName",
+    7411968: "TlvTypeTargetInfoExPropertyValueData",
+    7412384: "TlvTypeMasterAgentAlarm",
+    7413920: "TlvTypeMasterAgentRetrieveData",
+    7414176: "TlvTypeMasterAgentRetrieveDataAnswer",
+    7414432: "TlvTypeMasterAgentRemoveUser",
+    7414688: "TlvTypeMasterAgentRemoveTarget",
+    7414944: "TlvTypeMasterAgentRetrieveDataComments",
+    7415200: "TlvTypeMasterAgentUpdateDataComments",
+    7415712: "TlvTypeMasterAgentRetrieveActivityLogging",
+    7415968: "TlvTypeMasterAgentRetrieveMasterLogging",
+    7416224: "TlvTypeMasterAgentRetrieveAgentActivityLogging",
+    7417248: "TlvTypeMasterAgentSendUserGUIConfig",
+    7417504: "TlvTypeMasterAgentGetUserGUIConfigRequest",
+    7417760: "TlvTypeMasterAgentGetUserGUIConfigReply",
+    7418016: "TlvTypeMasterAgentProxyList",
+    7418272: "TlvTypeMasterAgentProxyInfoReply",
+    7419040: "TlvTypeMasterAgentNameValuePacket",
+    7419248: "TlvTypeMasterAgentValueName",
+    7419392: "TlvTypeMasterAgentValueData",
+    7419808: "TlvTypeMasterAgentRetrieveTargetHistory",
+    7421088: "TlvTypeMasterAgentInstallMasterLicense",
+    7421344: "TlvTypeMasterAgentInstallSoftwareUpdate",
+    7421600: "TlvTypeMasterAgentInstallSoftwareUpdateChunk",
+    7421856: "TlvTypeMasterAgentInstallSoftwareUpdateDone",
+    7422112: "TlvTypeMasterAgentSoftwareUpdateInfo",
+    7422368: "TlvTypeMasterAgentSoftwareUpdateInfoReply",
+    7422624: "TlvTypeMasterAgentSoftwareUpdate",
+    7422880: "TlvTypeMasterAgentSoftwareUpdateReply",
+    7423136: "TlvTypeMasterAgentSoftwareUpdateNext",
+    7423392: "TlvTypeMasterAgentAddTimeSchedule",
+    7423648: "TlvTypeMasterAgentAddScreenSchedule",
+    7423904: "TlvTypeMasterAgentAddLockedSchedule",
+    7424160: "TlvTypeMasterAgentRemoveSchedule",
+    7424416: "TlvTypeMasterAgentGetSchedulerList",
+    7424672: "TlvTypeMasterAgentSchedulerTimeAction",
+    7424928: "TlvTypeMasterAgentSchedulerScreenAction",
+    7425184: "TlvTypeMasterAgentSchedulerLockedAction",
+    7425440: "TlvTypeMasterAgentProjectSoftwareUpdateInfo",
+    7425696: "TlvTypeMasterAgentProjectSoftwareUpdateInfoReply",
+    7425952: "TlvTypeMasterAgentProjectSoftwareUpdate",
+    7426112: "TlvTypeMasterAgentSchedulerID",
+    7426368: "TlvTypeMasterAgentSchedulerStartTime",
+    7426624: "TlvTypeMasterAgentSchedulerStopTime",
+    7427488: "TlvTypeMasterAgentAddRecordedDataAvailableSchedule",
+    7427744: "TlvTypeMasterAgentSchedulerRecordedDataAvailableAction",
+    7428256: "TlvTypeMasterAgentRetrieveRemoteMasterData",
+    7428512: "TlvTypeMasterAgentRetrieveRemoteMasterDataReply",
+    7428768: "TlvTypeMasterAgentDeleteRemoteMasterData",
+    7429024: "TlvTypeMasterAgentRetrieveOfflineMasterData",
+    7429280: "TlvTypeMasterAgentRetrieveOfflineMasterDataReply",
+    7429536: "TlvTypeMasterAgentDeleteOfflineMasterData",
+    7430304: "TlvTypeMasterAgentQueryFirstEx",
+    7430560: "TlvTypeMasterAgentQueryNextEx",
+    7430816: "TlvTypeMasterAgentQueryLastEx",
+    7431072: "TlvTypeMasterAgentQueryAnswerEx",
+    7431328: "TlvTypeMasterAgentSendUserPreferences",
+    7431584: "TlvTypeMasterAgentGetUserPreferencesRequest",
+    7431840: "TlvTypeMasterAgentGetUserPreferencesReply",
+    7432096: "TlvTypeMasterAgentListMCFilesRequest",
+    8415392: "TlvTypeMasterAgentListMCFilesReply",
+    7432608: "TlvTypeMasterAgentDeleteMCFiles",
+    7432864: "TlvTypeMasterAgentSendMCFiles",
+    7433120: "TlvTypeMasterAgentMCStatisticsRequest",
+    7433376: "TlvTypeMasterAgentMCStatisticsReply",
+    7433616: "TlvTypeMasterAgentMCStatisticsValues",
+    7434400: "TlvTypeMasterAgentTrojanKeyRequest",
+    7434656: "TlvTypeMasterAgentTrojanKeyReply",
+    7434912: "TlvTypeMasterAgentEvProtectionX509Request",
+    7435168: "TlvTypeMasterAgentEvProtectionX509Reply",
+    7435424: "TlvTypeMasterAgentEvProtectionImportCert",
+    7435680: "TlvTypeMasterAgentEvProtectionImportCertCompleted",
+    7435936: "TlvTypeMasterAgentConfigurationRequest",
+    7436192: "TlvTypeMasterAgentConfigurationReply",
+    7436448: "TlvTypeMasterAgentConfigurationUpdateRequest",
+    7436704: "TlvTypeMasterAgentConfigurationUpdateRequestCompleted",
+    7436944: "TlvTypeMasterAgentConfiguration",
+    7437216: "TlvTypeMasterAgentConfigurationValue",
+    7437424: "TlvTypeMasterAgentConfigurationValueName",
+    7437568: "TlvTypeMasterAgentConfigurationValueData",
+    7437984: "TlvTypeMasterAgentConfigurationTransferDone",
+    7438496: "TlvTypeMasterAgentRetrieveTargetFile",
+    7438752: "TlvTypeMasterAgentRetrieveTargetFileAnswer",
+    7438912: "TlvTypeMasterAgentAlarmEntryID",
+    7439168: "TlvTypeMasterAgentAlarmEntryVersion",
+    7439424: "TlvTypeMasterAgentAlarmTriggerFlags",
+    7439776: "TlvTypeMasterAgentGetAlarmList",
+    7440032: "TlvTypeMasterAgentAddAlarmEntry",
+    7440288: "TlvTypeMasterAgentRemoveAlarmEntry",
+    7440544: "TlvTypeMasterAgentAlarmEntry",
+    7440800: "TlvTypeMasterAgentSystemStatus",
+    7441056: "TlvTypeMasterAgentSystemStatusRequest",
+    7441312: "TlvTypeMasterAgentSystemStatusReply",
+    7441552: "TlvTypeMasterAgentLicenseValues",
+    7441824: "TlvTypeMasterAgentLicenseValuesRequest",
+    7442080: "TlvTypeMasterAgentLicenseValuesReply",
+    7442592: "TlvTypeMasterAgentGetNetworkConfigurationRequest",
+    7442848: "TlvTypeMasterAgentSetNetworkConfigurationRequest",
+    7443104: "TlvTypeMasterAgentSetNetworkConfigurationReply",
+    7443360: "TlvTypeMasterAgentRetrieveAllowedModulesList",
+    7443616: "TlvTypeMasterAgentRetrieveAllowedModulesListAnswer",
+    7446688: "TlvTypeMasterAgentRemoveAllTargetData",
+    7446944: "TlvTypeMasterAgentForceDownloadRecordedData",
+    7447200: "TlvTypeMasterAgentTargetCreateNotification",
+    7447456: "TlvTypeMasterAgentMobileTargetInfoReply",
+    7447696: "TlvTypeMasterAgentMobileTargetInfoValues",
+    7450784: "TlvTypeMasterAgentAlert",
+    7454880: "TlvTypeMasterAgentAddUser",
+    7455392: "TlvTypeMasterAgentAddUserReply",
+    7455648: "TlvTypeMasterAgentModifyUser",
+    7455904: "TlvTypeMasterAgentSetUserPermission",
+    7456160: "TlvTypeMasterAgentSetTargetPermission",
+    7456400: "TlvTypeMasterAgentUserPermission",
+    7456656: "TlvTypeMasterAgentTargetPermission",
+    7456928: "TlvTypeMasterAgentUserPermissionValuePacket",
+    7457184: "TlvTypeMasterAgentTargetPermissionValuePacket",
+    7457344: "TlvTypeMasterAgentUserPermissionValueName",
+    7457600: "TlvTypeMasterAgentTargetPermissionValueName",
+    7457856: "TlvTypeMasterAgentUserPermissionValueData",
+    7458112: "TlvTypeMasterAgentTargetPermissionValueData",
+    7458464: "TlvTypeMasterAgentModifyPassword",
+    7458656: "TlvTypeMasterAgentMobileTargetPermissionValueName",
+    7458976: "TlvTypeMasterAgentUploadFile",
+    7459232: "TlvTypeMasterAgentUploadFileChunk",
+    7459488: "TlvTypeMasterAgentUploadFileDone",
+    7459744: "TlvTypeMasterAgentUploadFilesTransferDone",
+    7460000: "TlvTypeMasterAgentGetTargetModuleConfigRequest",
+    7460256: "TlvTypeMasterAgentRemoveFile",
+    7460512: "TlvTypeMasterAgentMobileProxyList",
+    7460768: "TlvTypeMasterAgentSMSProxyList",
+    7461024: "TlvTypeMasterAgentSMSProxyInfoReply",
+    7461280: "TlvTypeMasterAgentCallPhoneNumberList",
+    7461536: "TlvTypeMasterAgentCallPhoneNumberInfoReply",
+    7461792: "TlvTypeMasterAgentGetMobileTargetModuleConfigRequest",
+    7462048: "TlvTypeMasterAgentSendSMS",
+    7469984: "TlvTypeMasterAgentEncryptionRequired",
+    7470752: "TlvTypeAgentMasterComm",
+    7470240: "TlvTypeMasterAgentFileCompleted",
+    7470496: "TlvTypeMasterAgentRequestCompleted",
+    7471008: "TlvTypeMasterAgentRequestStatus",
+    7733664: "TlvTypeRelayProxyComm",
+    8454800: "TlvTypeRelayData",
+    7734176: "TlvTypeRelayDummyHeartbeat",
+    7668128: "TlvTypeMasterTargetComm",
+    7668384: "TlvTypeTargetCloseAllLiveStreaming",
+    7471424: "TlvTypeProxyMasterCommSig",
+    7471776: "TlvTypeProxyMasterComm",
+    7472032: "TlvTypeMasterProxyComm",
+    7472288: "TlvTypeProxyMasterHeartBeatAnswer",
+    7472544: "TlvTypeProxyMasterDisconnect",
+    7472704: "TlvTypeProxyMasterNotification",
+    7473056: "TlvTypeProxyMasterRequest",
+    7473312: "TlvTypeMasterProxyCommNotification",
+    7473568: "TlvTypeMasterCheckTargetDisconnect",
+    7536960: "TlvTypeProxyTargetCommSig",
+    7537312: "TlvTypeProxyTargetComm",
+    7537568: "TlvTypeProxyMasterTargetComm",
+    7537728: "TlvTypeProxyTargetRequestCrypto",
+    7538064: "TlvTypeProxyTargetAnswerCrypto",
+    8454544: "TlvTypeProxyData",
+    8458400: "TlvTypeProxyTargetDisconnect",
+    8458656: "TlvTypeProxyMobileTargetDisconnect",
+    8458912: "TlvTypeProxyDummyHeartbeat",
+    8459168: "TlvTypeProxyMobileDummyHeartbeat",
+    8585616: "TlvTypeAgentData",
+    8585808: "TlvTypeAgentQueryID",
+    8586048: "TlvTypeAgentQueryModSubmodID",
+    8586304: "TlvTypeAgentQueryFromDate",
+    8586560: "TlvTypeAgentQueryToDate",
+    8586816: "TlvTypeAgentQuerySortOrder",
+    8587136: "TlvTypeAgentQueryValueFilter",
+    8587328: "TlvTypeAgentUID",
+    8520080: "TlvTypeMasterData",
+    8520768: "TlvTypeMasterMode",
+    8521024: "TlvTypeMasterToken",
+    8521344: "TlvTypeMasterQueryResult",
+    8522368: "TlvTypeMasterAlarmString",
+    8651152: "TlvTypeMobileTargetData",
+    8651376: "TlvTypeMobileTargetHeartBeatV10",
+    8651632: "TlvTypeMobileTargetExtendedHeartBeatV10",
+    8651888: "TlvTypeMobileHeartBeatReplyV10",
+    8653472: "TlvTypeMobileInstalledModulesReply",
+    8656032: "TlvTypeMobileTargetUploadModuleRequest",
+    8656288: "TlvTypeMobileTargetUploadModuleReply",
+    8656544: "TlvTypeMobileTargetUploadModuleChunk",
+    8656800: "TlvTypeMobileTargetUploadModuleDoneRequest",
+    8657056: "TlvTypeMobileTargetUploadModuleDoneReply",
+    8657312: "TlvTypeMobileTargetRemoveModuleRequest",
+    8657568: "TlvTypeMobileTargetRemoveModuleReply",
+    8655008: "TlvTypeMobileTargetOfflineUploadModuleRequest",
+    8657824: "TlvTypeMobileTargetOfflineUploadModuleReply",
+    8658080: "TlvTypeMobileTargetOfflineUploadModuleChunk",
+    8658336: "TlvTypeMobileTargetOfflineUploadModuleDoneRequest",
+    8658592: "TlvTypeMobileTargetOfflineUploadModuleDoneReply",
+    8658848: "TlvTypeMobileTargetOfflineError",
+    8659104: "TlvTypeMobileTargetError",
+    8659360: "TlvTypeMobileTargetGetRecordedFilesRequest",
+    8659616: "TlvTypeMobileTargetRecordedFilesReply",
+    8659872: "TlvTypeMobileTargetRecordedFileDownloadRequest",
+    8660128: "TlvTypeMobileTargetRecordedFileDownloadReply",
+    8660384: "TlvTypeMobileTargetRecordedFileDownloadChunk",
+    8660640: "TlvTypeMobileTargetRecordedFileDownloadCompleted",
+    8660896: "TlvTypeMobileTargetRecordedFileDeleteRequest",
+    8661152: "TlvTypeMobileTargetRecordedFileDeleteReply",
+    8663968: "TlvTypeMobileTargetOfflineConfig",
+    8664224: "TlvTypeMobileTargetEmergencyConfigAsTLV",
+    8664432: "TlvTypeMobileTargetEmergencyConfig",
+    8671392: "TlvTypeMobileTargetLoadModuleRequest",
+    8671648: "TlvTypeMobileTargetLoadModuleReply",
+    8671904: "TlvTypeMobileTargetUnLoadModuleRequest",
+    8672160: "TlvTypeMobileTargetUnLoadModuleReply",
+    8675472: "TlvTypeMobileTargetHeartbeatEvents",
+    8675648: "TlvTypeMobileTargetHeartbeatInterval",
+    8675984: "TlvTypeMobileTargetHeartbeatRestrictions",
+    8676208: "TlvTypeConfigSMSPhoneNumber",
+    8676496: "TlvTypeMobileTargetPositioning",
+    8676672: "TlvTypeMobileTrojanUID",
+    8676976: "TlvTypeMobileTrojanID",
+    8677296: "TlvTypeMobileTargetLocationChangedRange",
+    8677440: "TlvTypeConfigMobileAutoRemovalDateTime",
+    8677808: "TlvTypeConfigOverwriteProxyAndPhones",
+    8678000: "TlvTypeConfigCallPhoneNumber",
+    8679488: "TlvTypeLocationAreaCode",
+    8679744: "TlvTypeCellID",
+    8680048: "TlvTypeMobileCountryCode",
+    8680304: "TlvTypeMobileNetworkCode",
+    8680560: "TlvTypeIMSI",
+    8680816: "TlvTypeIMEI",
+    8681072: "TlvTypeGPSLatitude",
+    8681328: "TlvTypeGPSLongitude",
+    8681520: "TlvTypeFirstHeartbeat",
+    8681872: "TlvTypeInstalledModules",
+    8683568: "TlvTypeValidGPSValues",
+    8389008: "TlvTypeTargetData",
+    8389280: "TlvTypeTargetHeartBeat",
+    8389680: "TlvTypeTargetKeepSessionAlive",
+    8390000: "TlvTypeTargetLocalIP",
+    8390256: "TlvTypeTargetGlobalIP",
+    8390448: "TlvTypeTargetState",
+    8390784: "TlvTypeTargetID",
+    8391072: "TlvTypeGetInstalledModulesRequest",
+    8391328: "TlvTypeInstalledModulesReply",
+    8391488: "TlvTypeTrojanUID",
+    8391808: "TlvTypeTrojanID",
+    8392000: "TlvTypeTrojanMaxInfections",
+    8392240: "TlvTypeScreenSaverOn",
+    8392496: "TlvTypeScreenLocked",
+    8392752: "TlvTypeRecordedDataAvailable",
+    8393024: "TlvTypeDownloadedRecordedDataTimeStamp",
+    8393280: "TlvTypeInstallationMode",
+    8393552: "TlvTypeTargetRemoveNotification",
+    8393792: "TlvTypeTargetPlatformBits",
+    8394032: "TlvTypeRemoveItselfMaxInfectionReached",
+    8394288: "TlvTypeRemoveItselfAtMasterRequest",
+    8394544: "TlvTypeRemoveItselfAtAgentRequest",
+    8394912: "TlvTypeRemoveItselfAtAgentReqRequest",
+    8395072: "TlvTypeRecordedFilesDownloadTotal",
+    8395328: "TlvTypeRecordedFilesDownloadProgress",
+    8395632: "TlvTypeTargetLicenseInfo",
+    8395840: "TlvTypeRemoveTargetLicenseInfo",
+    8396176: "TlvTypeTargetAllConfigurations",
+    8396960: "TlvTypeTargetError",
+    8401056: "TlvTypeGetTargetConfigRequest",
+    8401312: "TlvTypeTargetConfigReply",
+    8401568: "TlvTypeSetTargetConfigRequest",
+    8402304: "TlvTypeConfigTargetID",
+    8402496: "TlvTypeConfigTargetHeartbeatInterval",
+    8402800: "TlvTypeConfigTargetProxy",
+    8403008: "TlvTypeConfigTargetPort",
+    8403584: "TlvTypeConfigAutoRemovalDateTime",
+    8403776: "TlvTypeConfigAutoRemovalIfNoProxy",
+    8404032: "TlvTypeInternalAutoRemovalElapsedTime",
+    8405040: "TlvTypeConfigActiveHiding",
+    8409248: "TlvTypeTargetLoadModuleRequest",
+    8409504: "TlvTypeTargetLoadModuleReply",
+    8409760: "TlvTypeTargetUnLoadModuleRequest",
+    8410016: "TlvTypeTargetUnLoadModuleReply",
+    8410272: "TlvTypeTargetUploadModuleRequest",
+    8410528: "TlvTypeTargetUploadModuleReply",
+    8410784: "TlvTypeTargetUploadModuleChunk",
+    8411040: "TlvTypeTargetUploadModuleDoneRequest",
+    8411296: "TlvTypeTargetUploadModuleDoneReply",
+    8411552: "TlvTypeTargetRemoveModuleRequest",
+    8411808: "TlvTypeTargetRemoveModuleReply",
+    8412064: "TlvTypeTargetOfflineUploadModuleRequest",
+    8412320: "TlvTypeTargetOfflineUploadModuleReply",
+    8412576: "TlvTypeTargetOfflineUploadModuleChunk",
+    8412832: "TlvTypeTargetOfflineUploadModuleDoneRequest",
+    8413088: "TlvTypeTargetOfflineUploadModuleDoneReply",
+    8413344: "TlvTypeTargetOfflineError",
+    8413600: "TlvTypeTargetUploadError",
+    8417440: "TlvTypeTargetGetRecordedFilesRequest",
+    8417696: "TlvTypeTargetRecordedFilesReply",
+    8417952: "TlvTypeTargetRecordedFileDownloadRequest",
+    8418208: "TlvTypeTargetRecordedFileDownloadReply",
+    8418464: "TlvTypeTargetRecordedFileDownloadChunk",
+    8418720: "TlvTypeTargetRecordedFileDownloadCompleted",
+    8418976: "TlvTypeTargetRecordedFileDeleteRequest",
+    8419232: "TlvTypeTargetRecordedFileDeleteReply",
+    8419488: "TlvTypeTargetGetRecordedFilesRequestEx",
+    8419744: "TlvTypeTargetRecordedFilesReplyEx",
+    8420000: "TlvTypeTargetRecordedFileDeleteRequestEx",
+    8420256: "TlvTypeTargetRecordedFilesDownloadRequestEx",
+    16744768: "TlvTypeProxyConnectionBroken",
+    16712000: "TlvTypeTargetConnectionBroken",
+    16712256: "TlvTypeAgentConnectionBroken",
+    16712512: "TlvTypeTargetOffline",
+    16646544: "TlvTypePlaintext",
+    16646800: "TlvTypeCompression",
+    16647056: "TlvTypeEncryption",
+    16647232: "TlvTypeTargetUID",
+    16647536: "TlvTypeIPAddress",
+    16647808: "TlvTypeUserName",
+    16648064: "TlvTypeComputerName",
+    16648304: "TlvTypeLoginName",
+    16648560: "TlvTypePassphrase",
+    16648832: "TlvTypeRecordID",
+    16649088: "TlvTypeOwner",
+    16649344: "TlvTypeMetaData",
+    16649536: "TlvTypeModuleID",
+    16649856: "TlvTypeOSName",
+    16650048: "TlvTypeModuleSubID",
+    16650320: "TlvTypeErrorCode",
+    16650560: "TlvTypeOffset",
+    16650816: "TlvTypeLength",
+    16651088: "TlvTypeRequestID",
+    16651328: "TlvTypeRequestType",
+    16651584: "TlvTypeVersion",
+    16651840: "TlvTypeMachineID",
+    16652096: "TlvTypeMajorNumber",
+    16652352: "TlvTypeMinorNumber",
+    16652656: "TlvTypeGlobalIPAddress",
+    16652912: "TlvTypeASCII_Filename",
+    16653120: "TlvTypeFilesize",
+    16653392: "TlvTypeFilecount",
+    16653712: "TlvTypeFiledata",
+    16653968: "TlvTypeMD5Sum",
+    16654144: "TlvTypeProxyPort",
+    16654400: "TlvTypeStatus",
+    16654656: "TlvTypeUserID",
+    16654912: "TlvTypeGroupID",
+    16655168: "TlvTypePermissions",
+    16655424: "TlvTypeRequestCode",
+    16655680: "TlvTypeDataSize",
+    16655936: "TlvTypeKeyType",
+    16656240: "TlvTypeEmail",
+    16656432: "TlvTypeEnabled",
+    16656688: "TlvTypeLicensed",
+    16656960: "TlvTypeAudioFrequency",
+    16657216: "TlvTypeAudioBitsPerSample",
+    16657472: "TlvTypeAudioChannels",
+    16657728: "TlvTypeStartTime",
+    16657984: "TlvTypeStopTime",
+    16658240: "TlvTypeBitMask",
+    16658560: "TlvTypeTimeZone",
+    16658816: "TlvTypeDateTime",
+    16659072: "TlvTypeStartSessionDateTime",
+    16659328: "TlvTypeStopSessionDateTime",
+    16659520: "TlvTypeDateTimeRef",
+    16659776: "TlvTypeScheduleRepeat",
+    16660032: "TlvTypeUnixMasterDateTime",
+    16660288: "TlvTypeUnixUTCDateTime",
+    16660544: "TlvTypeDurationInSeconds",
+    16660864: "TlvTypeMasterRefTime",
+    16661120: "TlvTypeMasterRefTimeStart",
+    16661376: "TlvTypeMasterRefTimeEnd",
+    16661568: "TlvTypeCounter",
+    16661888: "TlvTypeWhiteListEntry",
+    16662144: "TlvTypeBlackListEntry",
+    16662336: "TlvTypeBlackWhiteListingMode",
+    16662576: "TlvTypeConfigEnabled",
+    16662848: "TlvTypeConfigMaxRecordingSize",
+    16663104: "TlvTypeConfigAudioQuality",
+    16663344: "TlvTypeConfigVideoBlackAndWhite",
+    16663616: "TlvTypeConfigVideoResolution",
+    16663872: "TlvTypeConfigCaptureFrequency",
+    16664128: "TlvTypeConfigVideoQuality",
+    16664384: "TlvTypeConfigFilesStandardFilter",
+    16664704: "TlvTypeConfigFilesCustomFilter",
+    16664896: "TlvTypeConfigStandardLocation",
+    16665216: "TlvTypeConfigCustomLocation",
+    16665408: "TlvTypeConfigFileChunkSize",
+    16665664: "TlvTypeConfigFileTransferSpeed",
+    16665904: "TlvTypeConfigUploadFileOverwrite",
+    16666160: "TlvTypeConfigDeleteOverReboot",
+    16666496: "TlvTypeConfigCustomLocationException",
+    16666752: "TlvTypeExtraData",
+    16667008: "TlvTypeSignature",
+    16667264: "TlvTypeComments",
+    16667520: "TlvTypeDescription",
+    16667776: "TlvTypeFilenameExtension",
+    16668032: "TlvTypeSessionType",
+    16668224: "TlvTypePeriod",
+    16668512: "TlvTypeMobileTargetUID",
+    16668784: "TlvTypeMobileTargetID",
+    16669072: "TlvTypeMobilePlaintext",
+    16669328: "TlvTypeMobileCompression",
+    16669584: "TlvTypeMobileEncryption",
+    16669824: "TlvTypeEncodingType",
+    16670576: "TlvTypePhoneNumber",
+    16670784: "TlvTypeConfigCustomLocationMode",
+    16674928: "TlvTypeNetworkInterface",
+    16675136: "TlvTypeNetworkInterfaceMode",
+    16675440: "TlvTypeNetworkInterfaceAddress",
+    16675696: "TlvTypeNetworkInterfaceNetmask",
+    16675952: "TlvTypeNetworkInterfaceGateway",
+    16676208: "TlvTypeNetworkInterfaceDNS_1",
+    16676464: "TlvTypeNetworkInterfaceDNS_2",
+    16677440: "TlvTypeLoginTime",
+    16677696: "TlvTypeLogoffTime",
+    16678720: "TlvTypeGeneric_Type",
+    16678976: "TlvTypeChecksum",
+    16679280: "TlvTypeCity",
+    16679536: "TlvTypeCountry",
+    16679792: "TlvTypeCountryCode",
+    16683072: "TlvTypeTargetType",
+    16683392: "TlvTypeDurationString",
+    8257792: "TlvTypeTestMetaTypeInvalid",
+    8258608: "TlvTypeTestMetaTypeBool",
+    8258880: "TlvTypeTestMetaTypeUInt",
+    8259152: "TlvTypeTestMetaTypeInt",
+    8259440: "TlvTypeTestMetaTypeString",
+    8259712: "TlvTypeTestMetaTypeUnicode",
+    8259984: "TlvTypeTestMetaTypeRaw",
+    8260256: "TlvTypeTestMetaTypeGroup",
+    8260416: "TlvTypeTestMemberIdentifier",
+    8260736: "TlvTypeTestMemberName",
+    0x2331a0: "TlvTypeVideoConfigReply", # Guess based on module
+    0x2431a0: "TlvTypeScreenRecordingConfigReply", # Guess
+    0x2731a0: "TlvTypeEmailConfigReply", # Guess
+    0x2831a0: "TlvTypeWifiConfigReply", # Guess
+    0x2931a0: "TlvTypeRemoteConfigReply", #Guess
+}
+
+NEED_RECURSION = ["TlvTypeChangedConfigReply", "TlvTypeTargetConfigReply",
+        "TlvTypeFileSystemConfigReply", "TlvTypeCmdLineConfigReply",
+        "TlvTypeSchedulerConfigReply", "TlvTypeMobileTargetOfflineConfig",
+        "TlvTypeMobileTrackingConfigRaw", "TlvTypeMobileTrackingConfig",
+        "0x544090", "0x5440a0", "0x534090", "0x5341a0"]
+
+
+def decode(m):
+    cfg = {}
+    while m.b.tell() < m._len:
+        size = m.dword()
+        tag = m.dword()
+        tag_type = (tag & 0xf0) >> 4
+        name = tlv_types.get(tag)
+        if tag_type < 4:
+            data = m.byte()
+        elif tag_type >= 6:
+            data = m.read(size - 8)
+            if tag_type == 8:
+                data = data.decode('utf-16')
+                if u"\u0380" in data:
+                    category, rest = data.split(u"\u0380")
+                    data = {'category': category, 'list': rest.split(u"\u0381")}
+        else:
+            data = m.dword()
+        if not name:
+            name = hex(tag)
+
+        if name in NEED_RECURSION or "ConfigReply" in name:
+            nm = M(data)
+            cfg[name] = decode(nm)
+        elif name in cfg and type(cfg[name]) != list:
+            olv = cfg[name]
+            cfg[name] = [olv, data]
+        elif name in cfg and type(cfg[name]) == list:
+            cfg[name].append(data)
+        elif name == "TlvTypeInstalledModules":
+            # Specific decoding for Android modules
+            olv = {"data": data}
+            olv["logging"] = (data[68] == 1)
+            olv["spycall"] = (data[64] == 1)
+            olv["call_interception"] = (data[65] == 1)
+            olv["sms"] = (data[66] == 1)
+            olv["addressbook"] = (data[67] == 1)
+            olv["tracking"] = (data[69] == 1)
+            olv["phonelogs"] = (data[70] == 1)
+            cfg[name] = olv
+        else:
+            cfg[name] = data
+
+    return cfg
+
+class MyEncoder(JSONEncoder):
+    """
+    JSON encoder to encode bytes
+    """
+    def default(self, o):
+        if isinstance(o, bytes):
+            try:
+                return o.decode('utf-8')
+            except UnicodeDecodeError:
+                return repr(o)
+        return o
+
+
+# From https://github.com/mak/mlib
+class M(object):
+    TRANSL = {'byte': ('B', 1), 'word': ('H', 2),
+              'dword': ('I', 4), 'qword': ('Q', 8)}
+
+    def __init__(self, d, end_fmt=''):
+        self._len = len(d)
+        self.b = BytesIO(d)
+
+    def _get_bytes(self, fmt, s, off):
+        return struct.unpack(fmt, self.read(off, s) if off else self.read(s))[0]
+
+    def skip(self, n):
+        self.b.seek(n, os.SEEK_CUR)
+
+    def unskip(self, n):
+        self.b.seek(-n, os.SEEK_CUR)
+
+    def read(self, a0, a1= None):
+        r = None
+        if a1 is None:
+            r = self.b.read(a0)
+        else:
+            r = self.read_at(a0,a1)
+        return r
+
+    def read_at(self, off, n):
+        old_l = self.b.tell()
+        self.b.seek(off, os.SEEK_SET)
+        r = self.b.read(n)
+        self.b.seek(old_l, os.SEEK_SET)
+        return r
+
+    def __len__(self):
+        return self._len
+
+    def __getattr__(self, name):
+        at = False
+        if name.endswith('_at'):
+            name = name[:-3]
+
+        if name in M.TRANSL:
+            f, s = M.TRANSL[name]
+            return lambda off = None: self._get_bytes(f, s, off)
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description='Decode FinSpy configuration files')
+    parser.add_argument('CONFFILE', help='Configuration file')
+    args = parser.parse_args()
+
+
+    with open(args.CONFFILE, 'rb') as f:
+        d = f.read()
+
+    m = M(d)
+    total_size = m.dword()
+    if total_size != len(d):
+        print("Encrypted configuration, decrypting...")
+        k = (0xaa, 0x5a, 0xa5)
+        r = bytearray()
+        for i, c in enumerate(bytearray(d)):
+            r.append(c ^ k[i % 3])
+        data = bytes(r)
+        m = M(data)
+        total_size = m.dword()
+
+    _ = m.dword() ## doesn't matter but config is wrapped into TlvTypeEncryption
+    cfg = decode(m)
+    print(json.dumps(cfg, cls=MyEncoder, indent=4))