57 lines
1.6 KiB
Python
57 lines
1.6 KiB
Python
import sys
|
|
import os
|
|
import struct
|
|
import hashlib
|
|
import ctypes
|
|
import binascii
|
|
import argparse
|
|
from Crypto.Cipher import AES
|
|
"""
|
|
Decode FinSpy modules for Linux and MacOS
|
|
|
|
Author : Maciek mak@malwarelab.pl
|
|
Date: August 2020
|
|
"""
|
|
|
|
|
|
def unpack(data, s=0):
|
|
"""
|
|
Decode the binary with aplib
|
|
"""
|
|
cin = ctypes.c_buffer(data)
|
|
cout = ctypes.c_buffer(s if s else len(data) * 20)
|
|
aplib_path = os.path.join(
|
|
os.path.dirname(os.path.realpath(__file__)),
|
|
"_aplib.so")
|
|
aPLIB = ctypes.cdll.LoadLibrary(aplib_path)
|
|
n = aPLIB.aP_depack(cin, cout)
|
|
return cout.raw[:n]
|
|
|
|
|
|
if __name__ == "__main__":
|
|
parser = argparse.ArgumentParser(description='Unpack FinSpy modules')
|
|
parser.add_argument('MODULE', help='Finspy module')
|
|
args = parser.parse_args()
|
|
|
|
with open(args.MODULE,'rb') as f:
|
|
hmd5 = f.read(0x10)
|
|
IV = f.read(0x10)
|
|
data = f.read()
|
|
|
|
hash_iv_data = hashlib.md5(IV + data)
|
|
if hmd5 == hash_iv_data.digest():
|
|
data = IV + data
|
|
IV = b'\xd9!V\xee\xbe\x0c\xf9\x18*\xfaR;%&\xb7\x08'
|
|
|
|
if hmd5 == hashlib.md5(data).digest():
|
|
print('[+] DATA HASH match {}'.format(binascii.hexlify(hmd5)))
|
|
|
|
key = b'YO\xf4\xa6\xd6\x1d\xd7!\xdc\x01A\xbfg\x83"m'
|
|
xdata = AES.new(key,mode=AES.MODE_CBC,IV=bytes(IV)).decrypt(data)
|
|
size = struct.unpack('I',xdata[:4])[0]
|
|
print('[+] Unpacked size: {:x}'.format(size))
|
|
depack = unpack(xdata[4:], size)
|
|
with open(args.MODULE + '.unpacked.bin','wb') as f:
|
|
f.write(depack)
|
|
print('[*] saved to {}.unpacked.bin'.format(sys.argv[1]))
|