[{"data":1,"prerenderedAt":6483},["ShallowReactive",2],{"blog-index-posts":3},[4],{"id":5,"title":6,"body":7,"date":6467,"description":6468,"extension":6469,"image":6470,"meta":6471,"navigation":240,"path":6472,"seo":6473,"sitemap":6474,"stem":6475,"tags":6476,"__hash__":6482},"blog\u002Fb\u002Fmolly.md","Molly | TRX CTF 2025",{"type":8,"value":9,"toc":6456},"minimark",[10,15,27,37,44,50,60,71,80,84,106,112,116,119,137,317,326,332,377,391,543,555,566,1598,1605,1723,2072,2099,2114,2118,2123,3213,3216,3222,3780,3784,3790,3796,3799,3806,3813,3816,3822,3826,3844,4470,4674,4819,4826,5116,5123,5391,5398,5817,5824,5830,5834,5837,5841,6432,6435,6439,6446,6452],[11,12,14],"h2",{"id":13},"overview","Overview",[16,17,18,19,23,24],"p",{},"We are presented with two PE x86_64 binaries: ",[20,21,22],"code",{},"molly.exe"," and ",[20,25,26],{},"molly_dll.dll",[16,28,29,30,32,33,36],{},"Initially, disassembling ",[20,31,22],{}," reveals a multitude of unusual instructions. Furthermore, the high entropy in the ",[20,34,35],{},".text"," section suggests that the code is not standard executable code.",[16,38,39],{},[40,41],"img",{"alt":42,"src":43},"static_first_view","\u002Fresources\u002Fmolly\u002Fstatic_first_view.png",[16,45,46,47,49],{},"At this point we try running ",[20,48,22],{}," and see it produces the following output:\n(binary is safe, you can also check VirusTotal)",[51,52,57],"pre",{"className":53,"code":55,"language":56},[54],"language-text","@@@@@@@@@@@@@@@@@@@ , @@@@@@@@@@@@@@@@@@\n@@@@@@@@@@@\u002F \u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F \u002F@@@@@@@@@@\n@@@@@@@\u002F \u002F\u002F* \u002F\u002F. \u002F@@@@@@\n@@@@@ \u002F \u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F \u002F\u002F \u002F @@@@\n@@@\u002F \u002F \u002F\u002F \u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F \u002F \u002F@@\n@@ \u002F\u002F \u002F\u002F\u002F\u002F\u002F\u002F\u002F \u002F\u002F\u002F\u002F\u002F\u002F \u002F \u002F. @\n@\u002F \u002F \u002F\u002F\u002F\u002F\u002F\u002F \u002F\u002F\u002F\u002F\u002F*,. \u002F \u002F\n@ \u002F \u002F\u002F\u002F\u002F\u002F \u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F \u002F\n, \u002F \u002F\u002F\u002F\u002F\u002F \u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F \u002F\n@ \u002F \u002F\u002F\u002F\u002F\u002F ,\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F \u002F\n@\u002F \u002F \u002F\u002F\u002F\u002F \u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F \u002F \u002F\n@@ *\u002F \u002F\u002F \u002F\u002F\u002F\u002F \u002F\u002F\u002F\u002F\u002F \u002F, @\n@@@\u002F \u002F \u002F\u002F\u002F\u002F ,\u002F\u002F\u002F\u002F \u002F \u002F@@\n@@@@@ \u002F *\u002F\u002F \u002F .@@@@\n@@@@@@@\u002F \u002F\u002F \u002F\u002F. \u002F@@@@@@\n@@@@@@@@@@@\u002F \u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F \u002F@@@@@@@@@@\n\n> SYSTEM VALIDATION IN PROGRESS\n> USER MUST INPUT THE VERIFICATION TOKEN molly.exe \u003Ctoken>\n> SYSTEM STATE: STOPPING\n> USE WITH CAUTION, NO FAILURES ALLOWED\n","text",[20,58,55],{"__ignoreMap":59},"",[16,61,62,66,67,70],{},[63,64,65],"strong",{},"Note:","\nUpon executing Molly with an incorrect token, the binary becomes corrupted and an additional executable named ",[20,68,69],{},"why.exe"," is generated.",[16,72,73,74,76,77,79],{},"At this point ",[20,75,26],{}," likely plays a critical role in unpacking or decrypting ",[20,78,22],{},", making it the logical starting point for further analysis.",[11,81,83],{"id":82},"molly-dynamic-overview","Molly Dynamic Overview",[16,85,86,87,89,90,92,93,96,97,101,102,105],{},"By setting a breakpoint at the entry point of ",[20,88,22],{}," using x64dbg and examining the memory regions corresponding to the ",[20,91,35],{}," section, we observed that the section is fragmented. Some regions are marked as ",[20,94,95],{},"NO_ACCESS",", while others have a fixed size of ",[98,99,100],"b",{},"0x1000"," with ",[20,103,104],{},"READ_EXECUTE"," permissions. This suggests that molly.exe is not packed; rather, it is unpacked or decrypted and executed at runtime.",[16,107,108],{},[40,109],{"alt":110,"src":111},"x64dbg_regions","\u002Fresources\u002Fmolly\u002Fx64dbg_regions.png",[11,113,115],{"id":114},"dll-static-analysis","Dll Static Analysis",[16,117,118],{},"When the Windows loader calls an imported DLL with an entry point, it executes on the main thread before the process's own entry point. As a result, the process entry point will not run until all DLL entry points have completed.",[16,120,121,122,125,126,128,129,132,133,136],{},"Disassembling the ",[20,123,124],{},"dll_main"," function within ",[20,127,26],{}," reveals a call to ",[20,130,131],{},"GetProcAddress"," for resolving ",[20,134,135],{},"KiUserExceptionDispatcher",":",[51,138,142],{"className":139,"code":140,"language":141,"meta":59,"style":59},"language-asm shiki shiki-themes github-dark-default","call qword [rel GetCurrentProcess]\nlea rcx, [rel data_180006c48] {\"ntdll.dll\"}\nmov rbx, rax\ncall qword [rel GetModuleHandleA]\ntest rax, rax\nje 0x180002fb3\n\nlea rdx, [rel data_180006c58] {\"KiUserExceptionDispatcher\"}\nmov rcx, rax\ncall qword [rel GetProcAddress]\nmov qword [rel KiUserExceptionDispatcher_Add], rax\ntest rax, rax\nje 0x180002fb3\n","asm",[20,143,144,166,184,199,213,226,235,242,257,268,282,299,310],{"__ignoreMap":59},[145,146,149,153,156,160,163],"span",{"class":147,"line":148},"line",1,[145,150,152],{"class":151},"suJrU","call",[145,154,155],{"class":151}," qword",[145,157,159],{"class":158},"sZEs4"," [",[145,161,162],{"class":151},"rel",[145,164,165],{"class":158}," GetCurrentProcess]\n",[145,167,169,172,176,179,181],{"class":147,"line":168},2,[145,170,171],{"class":151},"lea",[145,173,175],{"class":174},"sFSAA"," rcx",[145,177,178],{"class":158},", [",[145,180,162],{"class":151},[145,182,183],{"class":158}," data_180006c48] {\"ntdll.dll\"}\n",[145,185,187,190,193,196],{"class":147,"line":186},3,[145,188,189],{"class":151},"mov",[145,191,192],{"class":174}," rbx",[145,194,195],{"class":158},", ",[145,197,198],{"class":174},"rax\n",[145,200,202,204,206,208,210],{"class":147,"line":201},4,[145,203,152],{"class":151},[145,205,155],{"class":151},[145,207,159],{"class":158},[145,209,162],{"class":151},[145,211,212],{"class":158}," GetModuleHandleA]\n",[145,214,216,219,222,224],{"class":147,"line":215},5,[145,217,218],{"class":151},"test",[145,220,221],{"class":174}," rax",[145,223,195],{"class":158},[145,225,198],{"class":174},[145,227,229,232],{"class":147,"line":228},6,[145,230,231],{"class":151},"je",[145,233,234],{"class":174}," 0x180002fb3\n",[145,236,238],{"class":147,"line":237},7,[145,239,241],{"emptyLinePlaceholder":240},true,"\n",[145,243,245,247,250,252,254],{"class":147,"line":244},8,[145,246,171],{"class":151},[145,248,249],{"class":174}," rdx",[145,251,178],{"class":158},[145,253,162],{"class":151},[145,255,256],{"class":158}," data_180006c58] {\"KiUserExceptionDispatcher\"}\n",[145,258,260,262,264,266],{"class":147,"line":259},9,[145,261,189],{"class":151},[145,263,175],{"class":174},[145,265,195],{"class":158},[145,267,198],{"class":174},[145,269,271,273,275,277,279],{"class":147,"line":270},10,[145,272,152],{"class":151},[145,274,155],{"class":151},[145,276,159],{"class":158},[145,278,162],{"class":151},[145,280,281],{"class":158}," GetProcAddress]\n",[145,283,285,287,290,292,294,297],{"class":147,"line":284},11,[145,286,189],{"class":151},[145,288,289],{"class":151}," qword",[145,291,159],{"class":158},[145,293,162],{"class":151},[145,295,296],{"class":158}," KiUserExceptionDispatcher_Add], ",[145,298,198],{"class":174},[145,300,302,304,306,308],{"class":147,"line":301},12,[145,303,218],{"class":151},[145,305,221],{"class":174},[145,307,195],{"class":158},[145,309,198],{"class":174},[145,311,313,315],{"class":147,"line":312},13,[145,314,231],{"class":151},[145,316,234],{"class":174},[16,318,319,320,322,323,325],{},"The resolution of ",[20,321,135],{}," implies that ",[20,324,26],{}," is involved in Windows exception handling, which could be key to its runtime decryption capabilities. Also no standard exception handler appears to be registered... Let's look deeper",[16,327,328,329,331],{},"An effective obfuscation technique observed in ",[20,330,26],{}," is the inline use of system calls, which \"obscures\" the actual API functions being utilized:",[51,333,335],{"className":139,"code":334,"language":141,"meta":59,"style":59},"mov eax, 0x1c\nmov r10, rcx\nsyscall \nretn {__return_addr}\n",[20,336,337,349,361,369],{"__ignoreMap":59},[145,338,339,341,344,346],{"class":147,"line":148},[145,340,189],{"class":151},[145,342,343],{"class":174}," eax",[145,345,195],{"class":158},[145,347,348],{"class":174},"0x1c\n",[145,350,351,353,356,358],{"class":147,"line":168},[145,352,189],{"class":151},[145,354,355],{"class":174}," r10",[145,357,195],{"class":158},[145,359,360],{"class":174},"rcx\n",[145,362,363,366],{"class":147,"line":186},[145,364,365],{"class":151},"syscall",[145,367,368],{"class":158}," \n",[145,370,371,374],{"class":147,"line":201},[145,372,373],{"class":151},"retn",[145,375,376],{"class":158}," {__return_addr}\n",[16,378,379,380,383,384,387,388],{},"After looking for ",[20,381,382],{},"eax, 0x1c"," syscall signature inside ",[20,385,386],{},"ntdll.dll"," we can confirm this function is a reimplementation of ",[20,389,390],{},"NtSetInformationProcess",[51,392,394],{"className":139,"code":393,"language":141,"meta":59,"style":59},"lea rax, [rel sub_1800030b0]\nmov r9d, 0x10\nmov qword [rsp+0x28 {var_10_1}], rax {sub_1800030b0}\nlea r8, [rsp+0x20 {infostruct}]\nxor eax, eax {0x0}\nmov edx, 0x28\nmov rcx, rbx\nmov qword [rsp+0x20 {infostruct}], rax {0x0}\ncall NtSetInformationProcess\n",[20,395,396,410,422,448,467,488,500,511,536],{"__ignoreMap":59},[145,397,398,400,403,405,407],{"class":147,"line":148},[145,399,171],{"class":151},[145,401,402],{"class":174}," rax",[145,404,178],{"class":158},[145,406,162],{"class":151},[145,408,409],{"class":158}," sub_1800030b0]\n",[145,411,412,414,417,419],{"class":147,"line":168},[145,413,189],{"class":151},[145,415,416],{"class":174}," r9d",[145,418,195],{"class":158},[145,420,421],{"class":174},"0x10\n",[145,423,424,426,428,430,433,436,439,442,445],{"class":147,"line":186},[145,425,189],{"class":151},[145,427,289],{"class":151},[145,429,159],{"class":158},[145,431,432],{"class":174},"rsp",[145,434,435],{"class":158},"+",[145,437,438],{"class":174},"0x28",[145,440,441],{"class":158}," {var_10_1}], ",[145,443,444],{"class":174},"rax",[145,446,447],{"class":158}," {sub_1800030b0}\n",[145,449,450,452,455,457,459,461,464],{"class":147,"line":201},[145,451,171],{"class":151},[145,453,454],{"class":174}," r8",[145,456,178],{"class":158},[145,458,432],{"class":174},[145,460,435],{"class":158},[145,462,463],{"class":174},"0x20",[145,465,466],{"class":158}," {infostruct}]\n",[145,468,469,472,474,476,479,482,485],{"class":147,"line":215},[145,470,471],{"class":151},"xor",[145,473,343],{"class":174},[145,475,195],{"class":158},[145,477,478],{"class":174},"eax",[145,480,481],{"class":158}," {",[145,483,484],{"class":174},"0x0",[145,486,487],{"class":158},"}\n",[145,489,490,492,495,497],{"class":147,"line":228},[145,491,189],{"class":151},[145,493,494],{"class":174}," edx",[145,496,195],{"class":158},[145,498,499],{"class":174},"0x28\n",[145,501,502,504,506,508],{"class":147,"line":237},[145,503,189],{"class":151},[145,505,175],{"class":174},[145,507,195],{"class":158},[145,509,510],{"class":174},"rbx\n",[145,512,513,515,517,519,521,523,525,528,530,532,534],{"class":147,"line":244},[145,514,189],{"class":151},[145,516,289],{"class":151},[145,518,159],{"class":158},[145,520,432],{"class":174},[145,522,435],{"class":158},[145,524,463],{"class":174},[145,526,527],{"class":158}," {infostruct}], ",[145,529,444],{"class":174},[145,531,481],{"class":158},[145,533,484],{"class":174},[145,535,487],{"class":158},[145,537,538,540],{"class":147,"line":259},[145,539,152],{"class":151},[145,541,542],{"class":158}," NtSetInformationProcess\n",[16,544,545,547,548,551,552,554],{},[20,546,390],{}," is invoked with the undocumented ",[20,549,550],{},"PROCESSINFOCLASS"," value ",[98,553,438],{},", which is responsible for setting an InstrumentationCallback in the process structure.",[16,556,557,558,561,562,565],{},"The function ",[20,559,560],{},"sub_1800030b0"," acts as this callback, being invoked during a kernel-mode to user-mode transition with a special register ",[20,563,564],{},"r15"," that points to the target user-mode function.",[51,567,570],{"className":139,"code":568,"language":141,"meta":569,"style":59},"ic_hook:\npush r10 {var_8_1}\npush rax {var_10}\npushfq {var_18}\npush rbx {__saved_rbx}\nmov rbx, rsp {__saved_rbx}\nlea rax, [rel ic_hook_handler]\ncmp rcx, rax\ncmove rcx, r10\nlea r10, [rsp-0xc0 {var_e0}]\nand r10 {var_e0}, 0xfffffffffffffff0\nmov rsp, r10\ncld \nsub rsp, 0x60\nmov qword [rsp {var_140}], rcx\nmov qword [rsp+0x8 {__saved_rdx}], rdx\nmov qword [rsp+0x10 {__saved_rdi}], rdi\nmov qword [rsp+0x18 {__saved_rsi}], rsi\nmov qword [rsp+0x20 {__saved_r8}], r8\nmov qword [rsp+0x28 {__saved_r9}], r9\nmov qword [rsp+0x30 {__saved_r11}], r11\nmov qword [rsp+0x38 {__saved_r12}], r12\nmov qword [rsp+0x40 {__saved_r13}], r13\nmov qword [rsp+0x48 {__saved_r14}], r14\nmov qword [rsp+0x50 {__saved_r15}], r15\nsub rsp, 0x60\nmovaps xmmword [rsp {__saved_zmm0}], xmm0\nmovaps xmmword [rsp+0x10 {__saved_zmm1}], xmm1\nmovaps xmmword [rsp+0x20 {__saved_zmm2}], xmm2\nmovaps xmmword [rsp+0x30 {__saved_zmm3}], xmm3\nmovaps xmmword [rsp+0x40 {__saved_zmm4}], xmm4\nmovaps xmmword [rsp+0x50 {__saved_zmm5}], xmm5\nmov rdx, qword [rbx+0x10 {var_10}]\nmov rcx, qword [rbx+0x18 {var_8_1}]\ncall ic_hook_handler\nmov qword [rbx+0x18 {var_8}], rax\nmovaps xmm0, xmmword [rsp {__saved_zmm0}]\nmovaps xmm1, xmmword [rsp+0x10 {__saved_zmm1}]\nmovaps xmm2, xmmword [rsp+0x20 {__saved_zmm2}]\nmovaps xmm3, xmmword [rsp+0x30 {__saved_zmm3}]\nmovaps xmm4, xmmword [rsp+0x40 {__saved_zmm4}]\nmovaps xmm5, xmmword [rsp+0x50 {__saved_zmm5}]\nadd rsp, 0x60\nmov rcx, qword [rsp {var_140}]\nmov rdx, qword [rsp+0x8 {__saved_rdx}]\nmov rdi, qword [rsp+0x10 {__saved_rdi}]\nmov rsi, qword [rsp+0x18 {__saved_rsi}]\nmov r8, qword [rsp+0x20 {__saved_r8}]\nmov r9, qword [rsp+0x28 {__saved_r9}]\nmov r11, qword [rsp+0x30 {__saved_r11}]\nmov r12, qword [rsp+0x38 {__saved_r12}]\nmov r13, qword [rsp+0x40 {__saved_r13}]\nmov r14, qword [rsp+0x48 {__saved_r14}]\nmov r15, qword [rsp+0x50 {__saved_r15}]\nadd rsp, 0x60\nmov rsp, rbx\npop rbx {__saved_rbx}\npopfq \npop rax {var_10}\npop r10 {var_8}\njmp r10\n","IC handler stub",[20,571,572,578,589,598,606,616,628,641,652,665,684,697,708,716,729,745,767,789,811,832,853,875,897,919,941,963,974,991,1010,1029,1048,1067,1086,1110,1132,1140,1160,1176,1195,1214,1233,1252,1271,1283,1301,1323,1346,1369,1391,1414,1437,1460,1483,1506,1529,1540,1551,1561,1570,1579,1589],{"__ignoreMap":59},[145,573,574],{"class":147,"line":148},[145,575,577],{"class":576},"sc3cj","ic_hook:\n",[145,579,580,583,586],{"class":147,"line":168},[145,581,582],{"class":151},"push",[145,584,585],{"class":174}," r10",[145,587,588],{"class":158}," {var_8_1}\n",[145,590,591,593,595],{"class":147,"line":186},[145,592,582],{"class":151},[145,594,221],{"class":174},[145,596,597],{"class":158}," {var_10}\n",[145,599,600,603],{"class":147,"line":201},[145,601,602],{"class":151},"pushfq",[145,604,605],{"class":158}," {var_18}\n",[145,607,608,610,613],{"class":147,"line":215},[145,609,582],{"class":151},[145,611,612],{"class":174}," rbx",[145,614,615],{"class":158}," {__saved_rbx}\n",[145,617,618,620,622,624,626],{"class":147,"line":228},[145,619,189],{"class":151},[145,621,192],{"class":174},[145,623,195],{"class":158},[145,625,432],{"class":174},[145,627,615],{"class":158},[145,629,630,632,634,636,638],{"class":147,"line":237},[145,631,171],{"class":151},[145,633,402],{"class":174},[145,635,178],{"class":158},[145,637,162],{"class":151},[145,639,640],{"class":158}," ic_hook_handler]\n",[145,642,643,646,648,650],{"class":147,"line":244},[145,644,645],{"class":151},"cmp",[145,647,175],{"class":174},[145,649,195],{"class":158},[145,651,198],{"class":174},[145,653,654,657,660,662],{"class":147,"line":259},[145,655,656],{"class":151},"cmove",[145,658,659],{"class":174}," rcx",[145,661,195],{"class":158},[145,663,664],{"class":174},"r10\n",[145,666,667,669,671,673,675,678,681],{"class":147,"line":270},[145,668,171],{"class":151},[145,670,355],{"class":174},[145,672,178],{"class":158},[145,674,432],{"class":174},[145,676,677],{"class":158},"-",[145,679,680],{"class":174},"0xc0",[145,682,683],{"class":158}," {var_e0}]\n",[145,685,686,689,691,694],{"class":147,"line":284},[145,687,688],{"class":151},"and",[145,690,355],{"class":174},[145,692,693],{"class":158}," {var_e0}, ",[145,695,696],{"class":174},"0xfffffffffffffff0\n",[145,698,699,701,704,706],{"class":147,"line":301},[145,700,189],{"class":151},[145,702,703],{"class":174}," rsp",[145,705,195],{"class":158},[145,707,664],{"class":174},[145,709,710,713],{"class":147,"line":312},[145,711,712],{"class":151},"cld",[145,714,715],{"class":158}," \n",[145,717,719,722,724,726],{"class":147,"line":718},14,[145,720,721],{"class":151},"sub",[145,723,703],{"class":174},[145,725,195],{"class":158},[145,727,728],{"class":174},"0x60\n",[145,730,732,734,736,738,740,743],{"class":147,"line":731},15,[145,733,189],{"class":151},[145,735,289],{"class":151},[145,737,159],{"class":158},[145,739,432],{"class":174},[145,741,742],{"class":158}," {var_140}], ",[145,744,360],{"class":174},[145,746,748,750,752,754,756,758,761,764],{"class":147,"line":747},16,[145,749,189],{"class":151},[145,751,289],{"class":151},[145,753,159],{"class":158},[145,755,432],{"class":174},[145,757,435],{"class":158},[145,759,760],{"class":174},"0x8",[145,762,763],{"class":158}," {__saved_rdx}], ",[145,765,766],{"class":174},"rdx\n",[145,768,770,772,774,776,778,780,783,786],{"class":147,"line":769},17,[145,771,189],{"class":151},[145,773,289],{"class":151},[145,775,159],{"class":158},[145,777,432],{"class":174},[145,779,435],{"class":158},[145,781,782],{"class":174},"0x10",[145,784,785],{"class":158}," {__saved_rdi}], ",[145,787,788],{"class":174},"rdi\n",[145,790,792,794,796,798,800,802,805,808],{"class":147,"line":791},18,[145,793,189],{"class":151},[145,795,289],{"class":151},[145,797,159],{"class":158},[145,799,432],{"class":174},[145,801,435],{"class":158},[145,803,804],{"class":174},"0x18",[145,806,807],{"class":158}," {__saved_rsi}], ",[145,809,810],{"class":174},"rsi\n",[145,812,814,816,818,820,822,824,826,829],{"class":147,"line":813},19,[145,815,189],{"class":151},[145,817,289],{"class":151},[145,819,159],{"class":158},[145,821,432],{"class":174},[145,823,435],{"class":158},[145,825,463],{"class":174},[145,827,828],{"class":158}," {__saved_r8}], ",[145,830,831],{"class":174},"r8\n",[145,833,835,837,839,841,843,845,847,850],{"class":147,"line":834},20,[145,836,189],{"class":151},[145,838,289],{"class":151},[145,840,159],{"class":158},[145,842,432],{"class":174},[145,844,435],{"class":158},[145,846,438],{"class":174},[145,848,849],{"class":158}," {__saved_r9}], ",[145,851,852],{"class":174},"r9\n",[145,854,856,858,860,862,864,866,869,872],{"class":147,"line":855},21,[145,857,189],{"class":151},[145,859,289],{"class":151},[145,861,159],{"class":158},[145,863,432],{"class":174},[145,865,435],{"class":158},[145,867,868],{"class":174},"0x30",[145,870,871],{"class":158}," {__saved_r11}], ",[145,873,874],{"class":174},"r11\n",[145,876,878,880,882,884,886,888,891,894],{"class":147,"line":877},22,[145,879,189],{"class":151},[145,881,289],{"class":151},[145,883,159],{"class":158},[145,885,432],{"class":174},[145,887,435],{"class":158},[145,889,890],{"class":174},"0x38",[145,892,893],{"class":158}," {__saved_r12}], ",[145,895,896],{"class":174},"r12\n",[145,898,900,902,904,906,908,910,913,916],{"class":147,"line":899},23,[145,901,189],{"class":151},[145,903,289],{"class":151},[145,905,159],{"class":158},[145,907,432],{"class":174},[145,909,435],{"class":158},[145,911,912],{"class":174},"0x40",[145,914,915],{"class":158}," {__saved_r13}], ",[145,917,918],{"class":174},"r13\n",[145,920,922,924,926,928,930,932,935,938],{"class":147,"line":921},24,[145,923,189],{"class":151},[145,925,289],{"class":151},[145,927,159],{"class":158},[145,929,432],{"class":174},[145,931,435],{"class":158},[145,933,934],{"class":174},"0x48",[145,936,937],{"class":158}," {__saved_r14}], ",[145,939,940],{"class":174},"r14\n",[145,942,944,946,948,950,952,954,957,960],{"class":147,"line":943},25,[145,945,189],{"class":151},[145,947,289],{"class":151},[145,949,159],{"class":158},[145,951,432],{"class":174},[145,953,435],{"class":158},[145,955,956],{"class":174},"0x50",[145,958,959],{"class":158}," {__saved_r15}], ",[145,961,962],{"class":174},"r15\n",[145,964,966,968,970,972],{"class":147,"line":965},26,[145,967,721],{"class":151},[145,969,703],{"class":174},[145,971,195],{"class":158},[145,973,728],{"class":174},[145,975,977,980,983,985,988],{"class":147,"line":976},27,[145,978,979],{"class":151},"movaps",[145,981,982],{"class":158}," xmmword [",[145,984,432],{"class":174},[145,986,987],{"class":158}," {__saved_zmm0}], ",[145,989,990],{"class":174},"xmm0\n",[145,992,994,996,998,1000,1002,1004,1007],{"class":147,"line":993},28,[145,995,979],{"class":151},[145,997,982],{"class":158},[145,999,432],{"class":174},[145,1001,435],{"class":158},[145,1003,782],{"class":174},[145,1005,1006],{"class":158}," {__saved_zmm1}], ",[145,1008,1009],{"class":174},"xmm1\n",[145,1011,1013,1015,1017,1019,1021,1023,1026],{"class":147,"line":1012},29,[145,1014,979],{"class":151},[145,1016,982],{"class":158},[145,1018,432],{"class":174},[145,1020,435],{"class":158},[145,1022,463],{"class":174},[145,1024,1025],{"class":158}," {__saved_zmm2}], ",[145,1027,1028],{"class":174},"xmm2\n",[145,1030,1032,1034,1036,1038,1040,1042,1045],{"class":147,"line":1031},30,[145,1033,979],{"class":151},[145,1035,982],{"class":158},[145,1037,432],{"class":174},[145,1039,435],{"class":158},[145,1041,868],{"class":174},[145,1043,1044],{"class":158}," {__saved_zmm3}], ",[145,1046,1047],{"class":174},"xmm3\n",[145,1049,1051,1053,1055,1057,1059,1061,1064],{"class":147,"line":1050},31,[145,1052,979],{"class":151},[145,1054,982],{"class":158},[145,1056,432],{"class":174},[145,1058,435],{"class":158},[145,1060,912],{"class":174},[145,1062,1063],{"class":158}," {__saved_zmm4}], ",[145,1065,1066],{"class":174},"xmm4\n",[145,1068,1070,1072,1074,1076,1078,1080,1083],{"class":147,"line":1069},32,[145,1071,979],{"class":151},[145,1073,982],{"class":158},[145,1075,432],{"class":174},[145,1077,435],{"class":158},[145,1079,956],{"class":174},[145,1081,1082],{"class":158}," {__saved_zmm5}], ",[145,1084,1085],{"class":174},"xmm5\n",[145,1087,1089,1091,1093,1095,1098,1100,1103,1105,1107],{"class":147,"line":1088},33,[145,1090,189],{"class":151},[145,1092,249],{"class":174},[145,1094,195],{"class":158},[145,1096,1097],{"class":151},"qword",[145,1099,159],{"class":158},[145,1101,1102],{"class":174},"rbx",[145,1104,435],{"class":158},[145,1106,782],{"class":174},[145,1108,1109],{"class":158}," {var_10}]\n",[145,1111,1113,1115,1117,1119,1121,1123,1125,1127,1129],{"class":147,"line":1112},34,[145,1114,189],{"class":151},[145,1116,175],{"class":174},[145,1118,195],{"class":158},[145,1120,1097],{"class":151},[145,1122,159],{"class":158},[145,1124,1102],{"class":174},[145,1126,435],{"class":158},[145,1128,804],{"class":174},[145,1130,1131],{"class":158}," {var_8_1}]\n",[145,1133,1135,1137],{"class":147,"line":1134},35,[145,1136,152],{"class":151},[145,1138,1139],{"class":158}," ic_hook_handler\n",[145,1141,1143,1145,1147,1149,1151,1153,1155,1158],{"class":147,"line":1142},36,[145,1144,189],{"class":151},[145,1146,289],{"class":151},[145,1148,159],{"class":158},[145,1150,1102],{"class":174},[145,1152,435],{"class":158},[145,1154,804],{"class":174},[145,1156,1157],{"class":158}," {var_8}], ",[145,1159,198],{"class":174},[145,1161,1163,1165,1168,1171,1173],{"class":147,"line":1162},37,[145,1164,979],{"class":151},[145,1166,1167],{"class":174}," xmm0",[145,1169,1170],{"class":158},", xmmword [",[145,1172,432],{"class":174},[145,1174,1175],{"class":158}," {__saved_zmm0}]\n",[145,1177,1179,1181,1184,1186,1188,1190,1192],{"class":147,"line":1178},38,[145,1180,979],{"class":151},[145,1182,1183],{"class":174}," xmm1",[145,1185,1170],{"class":158},[145,1187,432],{"class":174},[145,1189,435],{"class":158},[145,1191,782],{"class":174},[145,1193,1194],{"class":158}," {__saved_zmm1}]\n",[145,1196,1198,1200,1203,1205,1207,1209,1211],{"class":147,"line":1197},39,[145,1199,979],{"class":151},[145,1201,1202],{"class":174}," xmm2",[145,1204,1170],{"class":158},[145,1206,432],{"class":174},[145,1208,435],{"class":158},[145,1210,463],{"class":174},[145,1212,1213],{"class":158}," {__saved_zmm2}]\n",[145,1215,1217,1219,1222,1224,1226,1228,1230],{"class":147,"line":1216},40,[145,1218,979],{"class":151},[145,1220,1221],{"class":174}," xmm3",[145,1223,1170],{"class":158},[145,1225,432],{"class":174},[145,1227,435],{"class":158},[145,1229,868],{"class":174},[145,1231,1232],{"class":158}," {__saved_zmm3}]\n",[145,1234,1236,1238,1241,1243,1245,1247,1249],{"class":147,"line":1235},41,[145,1237,979],{"class":151},[145,1239,1240],{"class":174}," xmm4",[145,1242,1170],{"class":158},[145,1244,432],{"class":174},[145,1246,435],{"class":158},[145,1248,912],{"class":174},[145,1250,1251],{"class":158}," {__saved_zmm4}]\n",[145,1253,1255,1257,1260,1262,1264,1266,1268],{"class":147,"line":1254},42,[145,1256,979],{"class":151},[145,1258,1259],{"class":174}," xmm5",[145,1261,1170],{"class":158},[145,1263,432],{"class":174},[145,1265,435],{"class":158},[145,1267,956],{"class":174},[145,1269,1270],{"class":158}," {__saved_zmm5}]\n",[145,1272,1274,1277,1279,1281],{"class":147,"line":1273},43,[145,1275,1276],{"class":151},"add",[145,1278,703],{"class":174},[145,1280,195],{"class":158},[145,1282,728],{"class":174},[145,1284,1286,1288,1290,1292,1294,1296,1298],{"class":147,"line":1285},44,[145,1287,189],{"class":151},[145,1289,175],{"class":174},[145,1291,195],{"class":158},[145,1293,1097],{"class":151},[145,1295,159],{"class":158},[145,1297,432],{"class":174},[145,1299,1300],{"class":158}," {var_140}]\n",[145,1302,1304,1306,1308,1310,1312,1314,1316,1318,1320],{"class":147,"line":1303},45,[145,1305,189],{"class":151},[145,1307,249],{"class":174},[145,1309,195],{"class":158},[145,1311,1097],{"class":151},[145,1313,159],{"class":158},[145,1315,432],{"class":174},[145,1317,435],{"class":158},[145,1319,760],{"class":174},[145,1321,1322],{"class":158}," {__saved_rdx}]\n",[145,1324,1326,1328,1331,1333,1335,1337,1339,1341,1343],{"class":147,"line":1325},46,[145,1327,189],{"class":151},[145,1329,1330],{"class":174}," rdi",[145,1332,195],{"class":158},[145,1334,1097],{"class":151},[145,1336,159],{"class":158},[145,1338,432],{"class":174},[145,1340,435],{"class":158},[145,1342,782],{"class":174},[145,1344,1345],{"class":158}," {__saved_rdi}]\n",[145,1347,1349,1351,1354,1356,1358,1360,1362,1364,1366],{"class":147,"line":1348},47,[145,1350,189],{"class":151},[145,1352,1353],{"class":174}," rsi",[145,1355,195],{"class":158},[145,1357,1097],{"class":151},[145,1359,159],{"class":158},[145,1361,432],{"class":174},[145,1363,435],{"class":158},[145,1365,804],{"class":174},[145,1367,1368],{"class":158}," {__saved_rsi}]\n",[145,1370,1372,1374,1376,1378,1380,1382,1384,1386,1388],{"class":147,"line":1371},48,[145,1373,189],{"class":151},[145,1375,454],{"class":174},[145,1377,195],{"class":158},[145,1379,1097],{"class":151},[145,1381,159],{"class":158},[145,1383,432],{"class":174},[145,1385,435],{"class":158},[145,1387,463],{"class":174},[145,1389,1390],{"class":158}," {__saved_r8}]\n",[145,1392,1394,1396,1399,1401,1403,1405,1407,1409,1411],{"class":147,"line":1393},49,[145,1395,189],{"class":151},[145,1397,1398],{"class":174}," r9",[145,1400,195],{"class":158},[145,1402,1097],{"class":151},[145,1404,159],{"class":158},[145,1406,432],{"class":174},[145,1408,435],{"class":158},[145,1410,438],{"class":174},[145,1412,1413],{"class":158}," {__saved_r9}]\n",[145,1415,1417,1419,1422,1424,1426,1428,1430,1432,1434],{"class":147,"line":1416},50,[145,1418,189],{"class":151},[145,1420,1421],{"class":174}," r11",[145,1423,195],{"class":158},[145,1425,1097],{"class":151},[145,1427,159],{"class":158},[145,1429,432],{"class":174},[145,1431,435],{"class":158},[145,1433,868],{"class":174},[145,1435,1436],{"class":158}," {__saved_r11}]\n",[145,1438,1440,1442,1445,1447,1449,1451,1453,1455,1457],{"class":147,"line":1439},51,[145,1441,189],{"class":151},[145,1443,1444],{"class":174}," r12",[145,1446,195],{"class":158},[145,1448,1097],{"class":151},[145,1450,159],{"class":158},[145,1452,432],{"class":174},[145,1454,435],{"class":158},[145,1456,890],{"class":174},[145,1458,1459],{"class":158}," {__saved_r12}]\n",[145,1461,1463,1465,1468,1470,1472,1474,1476,1478,1480],{"class":147,"line":1462},52,[145,1464,189],{"class":151},[145,1466,1467],{"class":174}," r13",[145,1469,195],{"class":158},[145,1471,1097],{"class":151},[145,1473,159],{"class":158},[145,1475,432],{"class":174},[145,1477,435],{"class":158},[145,1479,912],{"class":174},[145,1481,1482],{"class":158}," {__saved_r13}]\n",[145,1484,1486,1488,1491,1493,1495,1497,1499,1501,1503],{"class":147,"line":1485},53,[145,1487,189],{"class":151},[145,1489,1490],{"class":174}," r14",[145,1492,195],{"class":158},[145,1494,1097],{"class":151},[145,1496,159],{"class":158},[145,1498,432],{"class":174},[145,1500,435],{"class":158},[145,1502,934],{"class":174},[145,1504,1505],{"class":158}," {__saved_r14}]\n",[145,1507,1509,1511,1514,1516,1518,1520,1522,1524,1526],{"class":147,"line":1508},54,[145,1510,189],{"class":151},[145,1512,1513],{"class":174}," r15",[145,1515,195],{"class":158},[145,1517,1097],{"class":151},[145,1519,159],{"class":158},[145,1521,432],{"class":174},[145,1523,435],{"class":158},[145,1525,956],{"class":174},[145,1527,1528],{"class":158}," {__saved_r15}]\n",[145,1530,1532,1534,1536,1538],{"class":147,"line":1531},55,[145,1533,1276],{"class":151},[145,1535,703],{"class":174},[145,1537,195],{"class":158},[145,1539,728],{"class":174},[145,1541,1543,1545,1547,1549],{"class":147,"line":1542},56,[145,1544,189],{"class":151},[145,1546,703],{"class":174},[145,1548,195],{"class":158},[145,1550,510],{"class":174},[145,1552,1554,1557,1559],{"class":147,"line":1553},57,[145,1555,1556],{"class":151},"pop",[145,1558,192],{"class":174},[145,1560,615],{"class":158},[145,1562,1564,1567],{"class":147,"line":1563},58,[145,1565,1566],{"class":151},"popfq",[145,1568,1569],{"class":158}," \n",[145,1571,1573,1575,1577],{"class":147,"line":1572},59,[145,1574,1556],{"class":151},[145,1576,402],{"class":174},[145,1578,597],{"class":158},[145,1580,1582,1584,1586],{"class":147,"line":1581},60,[145,1583,1556],{"class":151},[145,1585,355],{"class":174},[145,1587,1588],{"class":158}," {var_8}\n",[145,1590,1592,1595],{"class":147,"line":1591},61,[145,1593,1594],{"class":151},"jmp",[145,1596,1597],{"class":174}," r10\n",[16,1599,1600,1601,1604],{},"The function in the middle is responsible for setting the return address. Basically, the argument it receives is the original return address and it compares it against one specific target function ",[20,1602,1603],{},"(KiUserExceptionDispatcher)",", if the addresses match up, then it returns a new hook otherwise it returns the argument passed.",[51,1606,1609],{"className":139,"code":1607,"language":141,"meta":1608,"style":59},"cld \nlea rcx, [rsp+0x4f0 {exp_record}]\nmov rdx, rsp {__return_addr}\ncall ki_user_exp_hook\ntest rax, rax\nje 0x1800031c0\n\njmp rax\n\ncld \nmov rcx, rsp {__return_addr}\nmov rdx, 0x0\ncall RtlRestoreContext {ic_hook_handler}\n","ki_user_exp_stub",[20,1610,1611,1617,1635,1648,1655,1665,1672,1676,1683,1687,1693,1705,1716],{"__ignoreMap":59},[145,1612,1613,1615],{"class":147,"line":148},[145,1614,712],{"class":151},[145,1616,715],{"class":158},[145,1618,1619,1621,1623,1625,1627,1629,1632],{"class":147,"line":168},[145,1620,171],{"class":151},[145,1622,175],{"class":174},[145,1624,178],{"class":158},[145,1626,432],{"class":174},[145,1628,435],{"class":158},[145,1630,1631],{"class":174},"0x4f0",[145,1633,1634],{"class":158}," {exp_record}]\n",[145,1636,1637,1639,1641,1643,1645],{"class":147,"line":186},[145,1638,189],{"class":151},[145,1640,249],{"class":174},[145,1642,195],{"class":158},[145,1644,432],{"class":174},[145,1646,1647],{"class":158}," {__return_addr}\n",[145,1649,1650,1652],{"class":147,"line":201},[145,1651,152],{"class":151},[145,1653,1654],{"class":158}," ki_user_exp_hook\n",[145,1656,1657,1659,1661,1663],{"class":147,"line":215},[145,1658,218],{"class":151},[145,1660,221],{"class":174},[145,1662,195],{"class":158},[145,1664,198],{"class":174},[145,1666,1667,1669],{"class":147,"line":228},[145,1668,231],{"class":151},[145,1670,1671],{"class":174}," 0x1800031c0\n",[145,1673,1674],{"class":147,"line":237},[145,1675,241],{"emptyLinePlaceholder":240},[145,1677,1678,1680],{"class":147,"line":244},[145,1679,1594],{"class":151},[145,1681,1682],{"class":174}," rax\n",[145,1684,1685],{"class":147,"line":259},[145,1686,241],{"emptyLinePlaceholder":240},[145,1688,1689,1691],{"class":147,"line":270},[145,1690,712],{"class":151},[145,1692,715],{"class":158},[145,1694,1695,1697,1699,1701,1703],{"class":147,"line":284},[145,1696,189],{"class":151},[145,1698,175],{"class":174},[145,1700,195],{"class":158},[145,1702,432],{"class":174},[145,1704,1647],{"class":158},[145,1706,1707,1709,1711,1713],{"class":147,"line":301},[145,1708,189],{"class":151},[145,1710,249],{"class":174},[145,1712,195],{"class":158},[145,1714,1715],{"class":174},"0x0\n",[145,1717,1718,1720],{"class":147,"line":312},[145,1719,152],{"class":151},[145,1721,1722],{"class":158}," RtlRestoreContext {ic_hook_handler}\n",[51,1724,1729],{"className":1725,"code":1726,"language":1727,"meta":1728,"style":59},"language-c shiki shiki-themes github-dark-default","if (exp_record->ExceptionCode == STATUS_ACCESS_VIOLATION && exp_record->ExceptionAddress)\n{\n uintptr_t page_base = exp_record->ExceptionInformation[1] & 0xfffffffffffff000;\n \n if (sub_180004110(&page_guard, page_base))\n {\n if (_Mtx_lock(&encryption_mutex))\n {\n std::_Throw_Cpp_error(5);\n \u002F* no return *\u002F\n }\n \n if (data_18000a05c == 0x7fffffff)\n {\n data_18000a05c = 0x7ffffffe;\n std::_Throw_Cpp_error(6);\n \u002F* no return *\u002F\n }\n \n sub_180003bd0(&page_guard, page_base);\n sub_180003de0(&page_guard);\n int64_t result = _Mtx_unlock(&encryption_mutex);\n exp_record->ExceptionCode = 0;\n exp_record->ExceptionFlags = 0;\n exp_record->ExceptionAddress = 0;\n exp_record->NumberParameters = 0;\n context->EFlags = 0xfe;\n return result; \u002F\u002F return 0\n }\n}\n\nreturn KiUserExceptionDispatcher_Add;\n","c","ki_user_exp_hook",[20,1730,1731,1762,1767,1799,1804,1823,1828,1845,1850,1863,1869,1874,1879,1896,1900,1914,1925,1929,1933,1937,1949,1961,1981,1993,2004,2015,2026,2040,2051,2056,2060,2064],{"__ignoreMap":59},[145,1732,1733,1736,1739,1742,1745,1748,1751,1754,1757,1759],{"class":147,"line":148},[145,1734,1735],{"class":151},"if",[145,1737,1738],{"class":158}," (exp_record",[145,1740,1741],{"class":151},"->",[145,1743,1744],{"class":158},"ExceptionCode ",[145,1746,1747],{"class":151},"==",[145,1749,1750],{"class":158}," STATUS_ACCESS_VIOLATION ",[145,1752,1753],{"class":151},"&&",[145,1755,1756],{"class":158}," exp_record",[145,1758,1741],{"class":151},[145,1760,1761],{"class":158},"ExceptionAddress)\n",[145,1763,1764],{"class":147,"line":168},[145,1765,1766],{"class":158},"{\n",[145,1768,1769,1772,1775,1778,1781,1784,1787,1790,1793,1796],{"class":147,"line":186},[145,1770,1771],{"class":151}," uintptr_t",[145,1773,1774],{"class":158}," page_base ",[145,1776,1777],{"class":151},"=",[145,1779,1780],{"class":158}," exp_record->ExceptionInformation[",[145,1782,1783],{"class":174},"1",[145,1785,1786],{"class":158},"] ",[145,1788,1789],{"class":151},"&",[145,1791,1792],{"class":151}," 0x",[145,1794,1795],{"class":174},"fffffffffffff000",[145,1797,1798],{"class":158},";\n",[145,1800,1801],{"class":147,"line":201},[145,1802,1803],{"class":158}," \n",[145,1805,1806,1809,1812,1815,1818,1820],{"class":147,"line":215},[145,1807,1808],{"class":151}," if",[145,1810,1811],{"class":158}," (",[145,1813,1814],{"class":576},"sub_180004110",[145,1816,1817],{"class":158},"(",[145,1819,1789],{"class":151},[145,1821,1822],{"class":158},"page_guard, page_base))\n",[145,1824,1825],{"class":147,"line":228},[145,1826,1827],{"class":158}," {\n",[145,1829,1830,1833,1835,1838,1840,1842],{"class":147,"line":237},[145,1831,1832],{"class":151}," if",[145,1834,1811],{"class":158},[145,1836,1837],{"class":576},"_Mtx_lock",[145,1839,1817],{"class":158},[145,1841,1789],{"class":151},[145,1843,1844],{"class":158},"encryption_mutex))\n",[145,1846,1847],{"class":147,"line":244},[145,1848,1849],{"class":158}," {\n",[145,1851,1852,1855,1857,1860],{"class":147,"line":259},[145,1853,1854],{"class":576}," std::_Throw_Cpp_error",[145,1856,1817],{"class":158},[145,1858,1859],{"class":174},"5",[145,1861,1862],{"class":158},");\n",[145,1864,1865],{"class":147,"line":270},[145,1866,1868],{"class":1867},"sH3jZ"," \u002F* no return *\u002F\n",[145,1870,1871],{"class":147,"line":284},[145,1872,1873],{"class":158}," }\n",[145,1875,1876],{"class":147,"line":301},[145,1877,1878],{"class":158}," \n",[145,1880,1881,1883,1886,1888,1890,1893],{"class":147,"line":312},[145,1882,1832],{"class":151},[145,1884,1885],{"class":158}," (data_18000a05c ",[145,1887,1747],{"class":151},[145,1889,1792],{"class":151},[145,1891,1892],{"class":174},"7fffffff",[145,1894,1895],{"class":158},")\n",[145,1897,1898],{"class":147,"line":718},[145,1899,1849],{"class":158},[145,1901,1902,1905,1907,1909,1912],{"class":147,"line":731},[145,1903,1904],{"class":158}," data_18000a05c ",[145,1906,1777],{"class":151},[145,1908,1792],{"class":151},[145,1910,1911],{"class":174},"7ffffffe",[145,1913,1798],{"class":158},[145,1915,1916,1918,1920,1923],{"class":147,"line":747},[145,1917,1854],{"class":576},[145,1919,1817],{"class":158},[145,1921,1922],{"class":174},"6",[145,1924,1862],{"class":158},[145,1926,1927],{"class":147,"line":769},[145,1928,1868],{"class":1867},[145,1930,1931],{"class":147,"line":791},[145,1932,1873],{"class":158},[145,1934,1935],{"class":147,"line":813},[145,1936,1878],{"class":158},[145,1938,1939,1942,1944,1946],{"class":147,"line":834},[145,1940,1941],{"class":576}," sub_180003bd0",[145,1943,1817],{"class":158},[145,1945,1789],{"class":151},[145,1947,1948],{"class":158},"page_guard, page_base);\n",[145,1950,1951,1954,1956,1958],{"class":147,"line":855},[145,1952,1953],{"class":576}," sub_180003de0",[145,1955,1817],{"class":158},[145,1957,1789],{"class":151},[145,1959,1960],{"class":158},"page_guard);\n",[145,1962,1963,1966,1969,1971,1974,1976,1978],{"class":147,"line":877},[145,1964,1965],{"class":151}," int64_t",[145,1967,1968],{"class":158}," result ",[145,1970,1777],{"class":151},[145,1972,1973],{"class":576}," _Mtx_unlock",[145,1975,1817],{"class":158},[145,1977,1789],{"class":151},[145,1979,1980],{"class":158},"encryption_mutex);\n",[145,1982,1983,1986,1988,1991],{"class":147,"line":899},[145,1984,1985],{"class":158}," exp_record->ExceptionCode ",[145,1987,1777],{"class":151},[145,1989,1990],{"class":174}," 0",[145,1992,1798],{"class":158},[145,1994,1995,1998,2000,2002],{"class":147,"line":921},[145,1996,1997],{"class":158}," exp_record->ExceptionFlags ",[145,1999,1777],{"class":151},[145,2001,1990],{"class":174},[145,2003,1798],{"class":158},[145,2005,2006,2009,2011,2013],{"class":147,"line":943},[145,2007,2008],{"class":158}," exp_record->ExceptionAddress ",[145,2010,1777],{"class":151},[145,2012,1990],{"class":174},[145,2014,1798],{"class":158},[145,2016,2017,2020,2022,2024],{"class":147,"line":965},[145,2018,2019],{"class":158}," exp_record->NumberParameters ",[145,2021,1777],{"class":151},[145,2023,1990],{"class":174},[145,2025,1798],{"class":158},[145,2027,2028,2031,2033,2035,2038],{"class":147,"line":976},[145,2029,2030],{"class":158}," context->EFlags ",[145,2032,1777],{"class":151},[145,2034,1792],{"class":151},[145,2036,2037],{"class":174},"fe",[145,2039,1798],{"class":158},[145,2041,2042,2045,2048],{"class":147,"line":993},[145,2043,2044],{"class":151}," return",[145,2046,2047],{"class":158}," result;",[145,2049,2050],{"class":1867}," \u002F\u002F return 0\n",[145,2052,2053],{"class":147,"line":1012},[145,2054,2055],{"class":158}," }\n",[145,2057,2058],{"class":147,"line":1031},[145,2059,487],{"class":158},[145,2061,2062],{"class":147,"line":1050},[145,2063,241],{"emptyLinePlaceholder":240},[145,2065,2066,2069],{"class":147,"line":1069},[145,2067,2068],{"class":151},"return",[145,2070,2071],{"class":158}," KiUserExceptionDispatcher_Add;\n",[16,2073,2074,2075,2077,2078,2081,2082,2084,2085,2088,2089,2091,2092,2094,2095,2098],{},"It is evident that ",[20,2076,1728],{}," handles ",[20,2079,2080],{},"STATUS_ACCESS_VIOLATION"," exceptions caused by attempts to access ",[20,2083,95],{}," pages, allowing ",[20,2086,2087],{},"sub_180003bd0"," to decrypt it. Once a guarded page is successfully decrypted, ",[20,2090,1608],{}," checks the return value from ",[20,2093,1728],{},". If the value is 0, it calls ",[20,2096,2097],{},"RtlRestoreContext"," to restore the execution state, allowing the binary to continue execution.",[2100,2101,2102],"blockquote",{},[16,2103,2104,2106,2107,2110,2113],{},[20,2105,1814],{}," check if the page is a guarded_page ",[2108,2109],"br",{},[20,2111,2112],{},"sub_180003de0"," is responsible to re-encrypts old pages, making runtime dumping \"ineffective\"",[11,2115,2117],{"id":2116},"binary-static-decryptor","Binary Static Decryptor",[16,2119,2120,2121,136],{},"Now let's look inside ",[20,2122,2087],{},[51,2124,2126],{"className":1725,"code":2125,"language":1727,"meta":59,"style":59},"void* decrypt_page(int32_t* arg1, uintptr_t page_base)\n\n{\n page_base_1 = page_base;\n void* result = sub_1800035f0(arg1, &page_base_1);\n \n if (result)\n {\n int64_t r8_16 = (((((((((((((((uint64_t)page_base ^ 0xcbf29ce484222325) * 0x100000001b3) ^ (uint64_t)(uint8_t)(page_base >> 8)) * 0x100000001b3) ^ (uint64_t)(uint8_t)(page_base >> 0x10)) * 0x100000001b3) ^ (uint64_t)(uint8_t)(page_base >> 0x18)) * 0x100000001b3) ^ (uint64_t)(uint8_t)(page_base >> 0x20)) * 0x100000001b3) ^ (uint64_t)(uint8_t)(page_base >> 0x28)) * 0x100000001b3) ^ (uint64_t)(uint8_t)(page_base >> 0x30)) * 0x100000001b3) ^ page_base >> 0x38;\n int64_t* rcx_9 = ((*(uint64_t*)((char*)arg1 + 0x30) & (r8_16 * 0x100000001b3)) \u003C\u003C 4) + *(uint64_t*)((char*)arg1 + 0x18);\n result = rcx_9[1];\n \n if (result == *(uint64_t*)((char*)arg1 + 8))\n {\n label_180003dcb:\n std::_Xout_of_range(\"invalid unordered_map\u003CK, T> key\");\n \u002F* no return *\u002F\n }\n \n while (page_base != *(uint64_t*)((char*)result + 0x10))\n {\n if (result == *(uint64_t*)rcx_9)\n goto label_180003dcb;\n \n result = *(uint64_t*)((char*)result + 8);\n }\n \n if (*(uint8_t*)((char*)result + 0x18))\n {\n flNewProtect = 0x1000;\n dwSize = page_base;\n void* var_38_1 = &arg_8;\n VirtualProtect(GetCurrentProcess(), &dwSize, &flNewProtect, 4);\n uintptr_t page_base_2 = page_base;\n int64_t r10_1 = 0;\n int64_t i_1 = 0x1000;\n int64_t i;\n \n do\n {\n uint8_t rax_15 = *(uint8_t*)page_base_2;\n page_base_2 += 1;\n int64_t rcx_12 = r10_1;\n uint8_t rotated_nibble = rax_15 >> 4 | rax_15 \u003C\u003C 4;\n int64_t rax_16;\n int64_t rdx_2;\n rdx_2 = HIGHQ(-0x7777777777777777 * r10_1);\n rax_16 = LOWQ(-0x7777777777777777 * r10_1);\n *(uint8_t*)(page_base_2 - 1) = rotated_nibble;\n r10_1 += 1;\n *(uint8_t*)(page_base_2 - 1) = rotated_nibble ^ page_guard_key[rcx_12 - (rdx_2 >> 3) * 0xf];\n i = i_1;\n i_1 -= 1;\n } while (i != 1);\n flNewProtect = 0x1000;\n dwSize = page_base;\n void* var_38_2 = &arg_8;\n VirtualProtect(GetCurrentProcess(), &dwSize, &flNewProtect, 0x20);\n return set_page_flag(arg1, page_base, false);\n }\n }\n \n return result;\n}\n",[20,2127,2128,2155,2159,2163,2173,2193,2197,2204,2208,2437,2518,2536,2540,2568,2572,2577,2590,2594,2598,2602,2634,2638,2656,2664,2669,2694,2698,2702,2729,2733,2747,2756,2772,2800,2812,2826,2841,2848,2852,2857,2862,2881,2894,2907,2933,2940,2947,2970,2990,3013,3024,3073,3083,3095,3112,3124,3132,3145,3170,3186,3190,3194,3199,3208],{"__ignoreMap":59},[145,2129,2130,2133,2136,2138,2141,2145,2147,2150,2153],{"class":147,"line":148},[145,2131,2132],{"class":151},"void*",[145,2134,2135],{"class":576}," decrypt_page",[145,2137,1817],{"class":158},[145,2139,2140],{"class":151},"int32_t*",[145,2142,2144],{"class":2143},"sQhOw"," arg1",[145,2146,195],{"class":158},[145,2148,2149],{"class":151},"uintptr_t",[145,2151,2152],{"class":2143}," page_base",[145,2154,1895],{"class":158},[145,2156,2157],{"class":147,"line":168},[145,2158,241],{"emptyLinePlaceholder":240},[145,2160,2161],{"class":147,"line":186},[145,2162,1766],{"class":158},[145,2164,2165,2168,2170],{"class":147,"line":201},[145,2166,2167],{"class":158}," page_base_1 ",[145,2169,1777],{"class":151},[145,2171,2172],{"class":158}," page_base;\n",[145,2174,2175,2178,2180,2182,2185,2188,2190],{"class":147,"line":215},[145,2176,2177],{"class":151}," void*",[145,2179,1968],{"class":158},[145,2181,1777],{"class":151},[145,2183,2184],{"class":576}," sub_1800035f0",[145,2186,2187],{"class":158},"(arg1, ",[145,2189,1789],{"class":151},[145,2191,2192],{"class":158},"page_base_1);\n",[145,2194,2195],{"class":147,"line":228},[145,2196,1803],{"class":158},[145,2198,2199,2201],{"class":147,"line":237},[145,2200,1808],{"class":151},[145,2202,2203],{"class":158}," (result)\n",[145,2205,2206],{"class":147,"line":244},[145,2207,1827],{"class":158},[145,2209,2210,2212,2215,2217,2220,2223,2226,2229,2231,2234,2237,2240,2242,2245,2247,2249,2251,2253,2256,2259,2262,2265,2268,2271,2273,2275,2277,2279,2281,2283,2285,2287,2289,2291,2293,2295,2298,2300,2302,2304,2306,2308,2310,2312,2314,2316,2318,2320,2322,2324,2327,2329,2331,2333,2335,2337,2339,2341,2343,2345,2347,2349,2351,2353,2356,2358,2360,2362,2364,2366,2368,2370,2372,2374,2376,2378,2380,2382,2385,2387,2389,2391,2393,2395,2397,2399,2401,2403,2405,2407,2409,2411,2414,2416,2418,2420,2422,2424,2426,2428,2430,2432,2435],{"class":147,"line":259},[145,2211,1965],{"class":151},[145,2213,2214],{"class":158}," r8_16 ",[145,2216,1777],{"class":151},[145,2218,2219],{"class":158}," (((((((((((((((",[145,2221,2222],{"class":151},"uint64_t",[145,2224,2225],{"class":158},")page_base ",[145,2227,2228],{"class":151},"^",[145,2230,1792],{"class":151},[145,2232,2233],{"class":174},"cbf29ce484222325",[145,2235,2236],{"class":158},") ",[145,2238,2239],{"class":151},"*",[145,2241,1792],{"class":151},[145,2243,2244],{"class":174},"100000001b3",[145,2246,2236],{"class":158},[145,2248,2228],{"class":151},[145,2250,1811],{"class":158},[145,2252,2222],{"class":151},[145,2254,2255],{"class":158},")(",[145,2257,2258],{"class":151},"uint8_t",[145,2260,2261],{"class":158},")(page_base ",[145,2263,2264],{"class":151},">>",[145,2266,2267],{"class":174}," 8",[145,2269,2270],{"class":158},")) ",[145,2272,2239],{"class":151},[145,2274,1792],{"class":151},[145,2276,2244],{"class":174},[145,2278,2236],{"class":158},[145,2280,2228],{"class":151},[145,2282,1811],{"class":158},[145,2284,2222],{"class":151},[145,2286,2255],{"class":158},[145,2288,2258],{"class":151},[145,2290,2261],{"class":158},[145,2292,2264],{"class":151},[145,2294,1792],{"class":151},[145,2296,2297],{"class":174},"10",[145,2299,2270],{"class":158},[145,2301,2239],{"class":151},[145,2303,1792],{"class":151},[145,2305,2244],{"class":174},[145,2307,2236],{"class":158},[145,2309,2228],{"class":151},[145,2311,1811],{"class":158},[145,2313,2222],{"class":151},[145,2315,2255],{"class":158},[145,2317,2258],{"class":151},[145,2319,2261],{"class":158},[145,2321,2264],{"class":151},[145,2323,1792],{"class":151},[145,2325,2326],{"class":174},"18",[145,2328,2270],{"class":158},[145,2330,2239],{"class":151},[145,2332,1792],{"class":151},[145,2334,2244],{"class":174},[145,2336,2236],{"class":158},[145,2338,2228],{"class":151},[145,2340,1811],{"class":158},[145,2342,2222],{"class":151},[145,2344,2255],{"class":158},[145,2346,2258],{"class":151},[145,2348,2261],{"class":158},[145,2350,2264],{"class":151},[145,2352,1792],{"class":151},[145,2354,2355],{"class":174},"20",[145,2357,2270],{"class":158},[145,2359,2239],{"class":151},[145,2361,1792],{"class":151},[145,2363,2244],{"class":174},[145,2365,2236],{"class":158},[145,2367,2228],{"class":151},[145,2369,1811],{"class":158},[145,2371,2222],{"class":151},[145,2373,2255],{"class":158},[145,2375,2258],{"class":151},[145,2377,2261],{"class":158},[145,2379,2264],{"class":151},[145,2381,1792],{"class":151},[145,2383,2384],{"class":174},"28",[145,2386,2270],{"class":158},[145,2388,2239],{"class":151},[145,2390,1792],{"class":151},[145,2392,2244],{"class":174},[145,2394,2236],{"class":158},[145,2396,2228],{"class":151},[145,2398,1811],{"class":158},[145,2400,2222],{"class":151},[145,2402,2255],{"class":158},[145,2404,2258],{"class":151},[145,2406,2261],{"class":158},[145,2408,2264],{"class":151},[145,2410,1792],{"class":151},[145,2412,2413],{"class":174},"30",[145,2415,2270],{"class":158},[145,2417,2239],{"class":151},[145,2419,1792],{"class":151},[145,2421,2244],{"class":174},[145,2423,2236],{"class":158},[145,2425,2228],{"class":151},[145,2427,1774],{"class":158},[145,2429,2264],{"class":151},[145,2431,1792],{"class":151},[145,2433,2434],{"class":174},"38",[145,2436,1798],{"class":158},[145,2438,2439,2442,2445,2447,2450,2452,2454,2457,2460,2463,2466,2468,2470,2472,2474,2476,2479,2481,2483,2485,2487,2490,2493,2495,2497,2500,2502,2504,2506,2508,2510,2512,2514,2516],{"class":147,"line":270},[145,2440,2441],{"class":151}," int64_t*",[145,2443,2444],{"class":158}," rcx_9 ",[145,2446,1777],{"class":151},[145,2448,2449],{"class":158}," ((",[145,2451,2239],{"class":151},[145,2453,1817],{"class":158},[145,2455,2456],{"class":151},"uint64_t*",[145,2458,2459],{"class":158},")((",[145,2461,2462],{"class":151},"char*",[145,2464,2465],{"class":158},")arg1 ",[145,2467,435],{"class":151},[145,2469,1792],{"class":151},[145,2471,2413],{"class":174},[145,2473,2236],{"class":158},[145,2475,1789],{"class":151},[145,2477,2478],{"class":158}," (r8_16 ",[145,2480,2239],{"class":151},[145,2482,1792],{"class":151},[145,2484,2244],{"class":174},[145,2486,2270],{"class":158},[145,2488,2489],{"class":151},"\u003C\u003C",[145,2491,2492],{"class":174}," 4",[145,2494,2236],{"class":158},[145,2496,435],{"class":151},[145,2498,2499],{"class":151}," *",[145,2501,1817],{"class":158},[145,2503,2456],{"class":151},[145,2505,2459],{"class":158},[145,2507,2462],{"class":151},[145,2509,2465],{"class":158},[145,2511,435],{"class":151},[145,2513,1792],{"class":151},[145,2515,2326],{"class":174},[145,2517,1862],{"class":158},[145,2519,2520,2523,2525,2528,2531,2533],{"class":147,"line":284},[145,2521,2522],{"class":158}," result ",[145,2524,1777],{"class":151},[145,2526,2527],{"class":2143}," rcx_9",[145,2529,2530],{"class":158},"[",[145,2532,1783],{"class":174},[145,2534,2535],{"class":158},"];\n",[145,2537,2538],{"class":147,"line":301},[145,2539,1878],{"class":158},[145,2541,2542,2544,2547,2549,2551,2553,2555,2557,2559,2561,2563,2565],{"class":147,"line":312},[145,2543,1832],{"class":151},[145,2545,2546],{"class":158}," (result ",[145,2548,1747],{"class":151},[145,2550,2499],{"class":151},[145,2552,1817],{"class":158},[145,2554,2456],{"class":151},[145,2556,2459],{"class":158},[145,2558,2462],{"class":151},[145,2560,2465],{"class":158},[145,2562,435],{"class":151},[145,2564,2267],{"class":174},[145,2566,2567],{"class":158},"))\n",[145,2569,2570],{"class":147,"line":718},[145,2571,1849],{"class":158},[145,2573,2574],{"class":147,"line":731},[145,2575,2576],{"class":158}," label_180003dcb:\n",[145,2578,2579,2582,2584,2588],{"class":147,"line":747},[145,2580,2581],{"class":576}," std::_Xout_of_range",[145,2583,1817],{"class":158},[145,2585,2587],{"class":2586},"s9uIt","\"invalid unordered_map\u003CK, T> key\"",[145,2589,1862],{"class":158},[145,2591,2592],{"class":147,"line":769},[145,2593,1868],{"class":1867},[145,2595,2596],{"class":147,"line":791},[145,2597,1873],{"class":158},[145,2599,2600],{"class":147,"line":813},[145,2601,1878],{"class":158},[145,2603,2604,2607,2610,2613,2615,2617,2619,2621,2623,2626,2628,2630,2632],{"class":147,"line":834},[145,2605,2606],{"class":151}," while",[145,2608,2609],{"class":158}," (page_base ",[145,2611,2612],{"class":151},"!=",[145,2614,2499],{"class":151},[145,2616,1817],{"class":158},[145,2618,2456],{"class":151},[145,2620,2459],{"class":158},[145,2622,2462],{"class":151},[145,2624,2625],{"class":158},")result ",[145,2627,435],{"class":151},[145,2629,1792],{"class":151},[145,2631,2297],{"class":174},[145,2633,2567],{"class":158},[145,2635,2636],{"class":147,"line":855},[145,2637,1849],{"class":158},[145,2639,2640,2643,2645,2647,2649,2651,2653],{"class":147,"line":877},[145,2641,2642],{"class":151}," if",[145,2644,2546],{"class":158},[145,2646,1747],{"class":151},[145,2648,2499],{"class":151},[145,2650,1817],{"class":158},[145,2652,2456],{"class":151},[145,2654,2655],{"class":158},")rcx_9)\n",[145,2657,2658,2661],{"class":147,"line":899},[145,2659,2660],{"class":151}," goto",[145,2662,2663],{"class":158}," label_180003dcb;\n",[145,2665,2666],{"class":147,"line":921},[145,2667,2668],{"class":158}," \n",[145,2670,2671,2674,2676,2678,2680,2682,2684,2686,2688,2690,2692],{"class":147,"line":943},[145,2672,2673],{"class":158}," result ",[145,2675,1777],{"class":151},[145,2677,2499],{"class":151},[145,2679,1817],{"class":158},[145,2681,2456],{"class":151},[145,2683,2459],{"class":158},[145,2685,2462],{"class":151},[145,2687,2625],{"class":158},[145,2689,435],{"class":151},[145,2691,2267],{"class":174},[145,2693,1862],{"class":158},[145,2695,2696],{"class":147,"line":965},[145,2697,1873],{"class":158},[145,2699,2700],{"class":147,"line":976},[145,2701,1878],{"class":158},[145,2703,2704,2706,2708,2710,2712,2715,2717,2719,2721,2723,2725,2727],{"class":147,"line":993},[145,2705,1832],{"class":151},[145,2707,1811],{"class":158},[145,2709,2239],{"class":151},[145,2711,1817],{"class":158},[145,2713,2714],{"class":151},"uint8_t*",[145,2716,2459],{"class":158},[145,2718,2462],{"class":151},[145,2720,2625],{"class":158},[145,2722,435],{"class":151},[145,2724,1792],{"class":151},[145,2726,2326],{"class":174},[145,2728,2567],{"class":158},[145,2730,2731],{"class":147,"line":1012},[145,2732,1849],{"class":158},[145,2734,2735,2738,2740,2742,2745],{"class":147,"line":1031},[145,2736,2737],{"class":158}," flNewProtect ",[145,2739,1777],{"class":151},[145,2741,1792],{"class":151},[145,2743,2744],{"class":174},"1000",[145,2746,1798],{"class":158},[145,2748,2749,2752,2754],{"class":147,"line":1050},[145,2750,2751],{"class":158}," dwSize ",[145,2753,1777],{"class":151},[145,2755,2172],{"class":158},[145,2757,2758,2761,2764,2766,2769],{"class":147,"line":1069},[145,2759,2760],{"class":151}," void*",[145,2762,2763],{"class":158}," var_38_1 ",[145,2765,1777],{"class":151},[145,2767,2768],{"class":151}," &",[145,2770,2771],{"class":158},"arg_8;\n",[145,2773,2774,2777,2779,2782,2785,2787,2790,2792,2795,2798],{"class":147,"line":1088},[145,2775,2776],{"class":576}," VirtualProtect",[145,2778,1817],{"class":158},[145,2780,2781],{"class":576},"GetCurrentProcess",[145,2783,2784],{"class":158},"(), ",[145,2786,1789],{"class":151},[145,2788,2789],{"class":158},"dwSize, ",[145,2791,1789],{"class":151},[145,2793,2794],{"class":158},"flNewProtect, ",[145,2796,2797],{"class":174},"4",[145,2799,1862],{"class":158},[145,2801,2802,2805,2808,2810],{"class":147,"line":1112},[145,2803,2804],{"class":151}," uintptr_t",[145,2806,2807],{"class":158}," page_base_2 ",[145,2809,1777],{"class":151},[145,2811,2172],{"class":158},[145,2813,2814,2817,2820,2822,2824],{"class":147,"line":1134},[145,2815,2816],{"class":151}," int64_t",[145,2818,2819],{"class":158}," r10_1 ",[145,2821,1777],{"class":151},[145,2823,1990],{"class":174},[145,2825,1798],{"class":158},[145,2827,2828,2830,2833,2835,2837,2839],{"class":147,"line":1142},[145,2829,2816],{"class":151},[145,2831,2832],{"class":158}," i_1 ",[145,2834,1777],{"class":151},[145,2836,1792],{"class":151},[145,2838,2744],{"class":174},[145,2840,1798],{"class":158},[145,2842,2843,2845],{"class":147,"line":1162},[145,2844,2816],{"class":151},[145,2846,2847],{"class":158}," i;\n",[145,2849,2850],{"class":147,"line":1178},[145,2851,2668],{"class":158},[145,2853,2854],{"class":147,"line":1197},[145,2855,2856],{"class":151}," do\n",[145,2858,2859],{"class":147,"line":1216},[145,2860,2861],{"class":158}," {\n",[145,2863,2864,2867,2870,2872,2874,2876,2878],{"class":147,"line":1235},[145,2865,2866],{"class":151}," uint8_t",[145,2868,2869],{"class":158}," rax_15 ",[145,2871,1777],{"class":151},[145,2873,2499],{"class":151},[145,2875,1817],{"class":158},[145,2877,2714],{"class":151},[145,2879,2880],{"class":158},")page_base_2;\n",[145,2882,2883,2886,2889,2892],{"class":147,"line":1254},[145,2884,2885],{"class":158}," page_base_2 ",[145,2887,2888],{"class":151},"+=",[145,2890,2891],{"class":174}," 1",[145,2893,1798],{"class":158},[145,2895,2896,2899,2902,2904],{"class":147,"line":1273},[145,2897,2898],{"class":151}," int64_t",[145,2900,2901],{"class":158}," rcx_12 ",[145,2903,1777],{"class":151},[145,2905,2906],{"class":158}," r10_1;\n",[145,2908,2909,2911,2914,2916,2918,2920,2922,2925,2927,2929,2931],{"class":147,"line":1285},[145,2910,2866],{"class":151},[145,2912,2913],{"class":158}," rotated_nibble ",[145,2915,1777],{"class":151},[145,2917,2869],{"class":158},[145,2919,2264],{"class":151},[145,2921,2492],{"class":174},[145,2923,2924],{"class":151}," |",[145,2926,2869],{"class":158},[145,2928,2489],{"class":151},[145,2930,2492],{"class":174},[145,2932,1798],{"class":158},[145,2934,2935,2937],{"class":147,"line":1303},[145,2936,2898],{"class":151},[145,2938,2939],{"class":158}," rax_16;\n",[145,2941,2942,2944],{"class":147,"line":1325},[145,2943,2898],{"class":151},[145,2945,2946],{"class":158}," rdx_2;\n",[145,2948,2949,2952,2954,2957,2959,2962,2965,2967],{"class":147,"line":1348},[145,2950,2951],{"class":158}," rdx_2 ",[145,2953,1777],{"class":151},[145,2955,2956],{"class":576}," HIGHQ",[145,2958,1817],{"class":158},[145,2960,2961],{"class":151},"-0x",[145,2963,2964],{"class":174},"7777777777777777",[145,2966,2499],{"class":151},[145,2968,2969],{"class":158}," r10_1);\n",[145,2971,2972,2975,2977,2980,2982,2984,2986,2988],{"class":147,"line":1371},[145,2973,2974],{"class":158}," rax_16 ",[145,2976,1777],{"class":151},[145,2978,2979],{"class":576}," LOWQ",[145,2981,1817],{"class":158},[145,2983,2961],{"class":151},[145,2985,2964],{"class":174},[145,2987,2499],{"class":151},[145,2989,2969],{"class":158},[145,2991,2992,2995,2997,2999,3002,3004,3006,3008,3010],{"class":147,"line":1393},[145,2993,2994],{"class":151}," *",[145,2996,1817],{"class":158},[145,2998,2714],{"class":151},[145,3000,3001],{"class":158},")(page_base_2 ",[145,3003,677],{"class":151},[145,3005,2891],{"class":174},[145,3007,2236],{"class":158},[145,3009,1777],{"class":151},[145,3011,3012],{"class":158}," rotated_nibble;\n",[145,3014,3015,3018,3020,3022],{"class":147,"line":1416},[145,3016,3017],{"class":158}," r10_1 ",[145,3019,2888],{"class":151},[145,3021,2891],{"class":174},[145,3023,1798],{"class":158},[145,3025,3026,3028,3030,3032,3034,3036,3038,3040,3042,3044,3046,3049,3052,3054,3057,3059,3062,3064,3066,3068,3071],{"class":147,"line":1439},[145,3027,2994],{"class":151},[145,3029,1817],{"class":158},[145,3031,2714],{"class":151},[145,3033,3001],{"class":158},[145,3035,677],{"class":151},[145,3037,2891],{"class":174},[145,3039,2236],{"class":158},[145,3041,1777],{"class":151},[145,3043,2913],{"class":158},[145,3045,2228],{"class":151},[145,3047,3048],{"class":2143}," page_guard_key",[145,3050,3051],{"class":158},"[rcx_12 ",[145,3053,677],{"class":151},[145,3055,3056],{"class":158}," (rdx_2 ",[145,3058,2264],{"class":151},[145,3060,3061],{"class":174}," 3",[145,3063,2236],{"class":158},[145,3065,2239],{"class":151},[145,3067,1792],{"class":151},[145,3069,3070],{"class":174},"f",[145,3072,2535],{"class":158},[145,3074,3075,3078,3080],{"class":147,"line":1462},[145,3076,3077],{"class":158}," i ",[145,3079,1777],{"class":151},[145,3081,3082],{"class":158}," i_1;\n",[145,3084,3085,3088,3091,3093],{"class":147,"line":1485},[145,3086,3087],{"class":158}," i_1 ",[145,3089,3090],{"class":151},"-=",[145,3092,2891],{"class":174},[145,3094,1798],{"class":158},[145,3096,3097,3100,3103,3106,3108,3110],{"class":147,"line":1508},[145,3098,3099],{"class":158}," } ",[145,3101,3102],{"class":151},"while",[145,3104,3105],{"class":158}," (i ",[145,3107,2612],{"class":151},[145,3109,2891],{"class":174},[145,3111,1862],{"class":158},[145,3113,3114,3116,3118,3120,3122],{"class":147,"line":1531},[145,3115,2737],{"class":158},[145,3117,1777],{"class":151},[145,3119,1792],{"class":151},[145,3121,2744],{"class":174},[145,3123,1798],{"class":158},[145,3125,3126,3128,3130],{"class":147,"line":1542},[145,3127,2751],{"class":158},[145,3129,1777],{"class":151},[145,3131,2172],{"class":158},[145,3133,3134,3136,3139,3141,3143],{"class":147,"line":1553},[145,3135,2760],{"class":151},[145,3137,3138],{"class":158}," var_38_2 ",[145,3140,1777],{"class":151},[145,3142,2768],{"class":151},[145,3144,2771],{"class":158},[145,3146,3147,3149,3151,3153,3155,3157,3159,3161,3163,3166,3168],{"class":147,"line":1563},[145,3148,2776],{"class":576},[145,3150,1817],{"class":158},[145,3152,2781],{"class":576},[145,3154,2784],{"class":158},[145,3156,1789],{"class":151},[145,3158,2789],{"class":158},[145,3160,1789],{"class":151},[145,3162,2794],{"class":158},[145,3164,3165],{"class":151},"0x",[145,3167,2355],{"class":174},[145,3169,1862],{"class":158},[145,3171,3172,3175,3178,3181,3184],{"class":147,"line":1572},[145,3173,3174],{"class":151}," return",[145,3176,3177],{"class":576}," set_page_flag",[145,3179,3180],{"class":158},"(arg1, page_base, ",[145,3182,3183],{"class":174},"false",[145,3185,1862],{"class":158},[145,3187,3188],{"class":147,"line":1581},[145,3189,1873],{"class":158},[145,3191,3192],{"class":147,"line":1591},[145,3193,2055],{"class":158},[145,3195,3197],{"class":147,"line":3196},62,[145,3198,1803],{"class":158},[145,3200,3202,3205],{"class":147,"line":3201},63,[145,3203,3204],{"class":151}," return",[145,3206,3207],{"class":158}," result;\n",[145,3209,3211],{"class":147,"line":3210},64,[145,3212,487],{"class":158},[16,3214,3215],{},"MollyDll decryption routine is quite simple, it first xor using a known key and then rotate the byte nibbles.",[16,3217,3218,3219,3221],{},"We can write a simple python script that decrypt ",[20,3220,22],{}," .text section:",[51,3223,3227],{"className":3224,"code":3225,"language":3226,"meta":59,"style":59},"language-py shiki shiki-themes github-dark-default","import sys\nimport pefile\n\nkey = [0x66,0x6f,0x72,0x67,0x69,0x76,0x65,0x6d,0x65,0x66,0x61,0x74,0x68,0x65,0x72]\ndef invert_nibbles(b):\n return (b & 0xf0) >> 4 | (b & 0x0f) \u003C\u003C 4 \n\ndef main():\n if len(sys.argv) != 2:\n sys.exit(1)\n\n pe_path = sys.argv[1]\n\n try:\n pe = pefile.PE(pe_path)\n except Exception as e:\n sys.exit(1)\n\n text_section = None\n for section in pe.sections:\n if b'.text' in section.Name:\n text_section = section\n break\n\n if text_section is None:\n sys.exit(2)\n\n data = bytearray(text_section.get_data())\n pages = text_section.SizeOfRawData \u002F\u002F 0x1000\n \n for i in range(pages):\n offset = i * 0x1000\n for j in range(0x1000):\n data[offset + j] = invert_nibbles(data[offset + j])\n data[offset + j] ^= key[j % len(key)]\n\n pe.set_bytes_at_offset(text_section.PointerToRawData, bytes(data))\n pe.write('molly_dec.exe')\n \nif __name__ == \"__main__\":\n main()\n","py",[20,3228,3229,3237,3244,3248,3360,3371,3410,3414,3424,3442,3451,3455,3469,3473,3480,3490,3504,3512,3516,3526,3540,3556,3566,3571,3575,3590,3599,3603,3616,3634,3638,3653,3668,3689,3709,3731,3735,3746,3756,3760,3775],{"__ignoreMap":59},[145,3230,3231,3234],{"class":147,"line":148},[145,3232,3233],{"class":151},"import",[145,3235,3236],{"class":158}," sys\n",[145,3238,3239,3241],{"class":147,"line":168},[145,3240,3233],{"class":151},[145,3242,3243],{"class":158}," pefile\n",[145,3245,3246],{"class":147,"line":186},[145,3247,241],{"emptyLinePlaceholder":240},[145,3249,3250,3253,3255,3257,3259,3262,3265,3267,3270,3272,3274,3277,3279,3281,3284,3286,3288,3291,3293,3295,3298,3300,3302,3305,3307,3309,3312,3314,3316,3318,3320,3322,3324,3326,3328,3331,3333,3335,3338,3340,3342,3345,3347,3349,3351,3353,3355,3357],{"class":147,"line":201},[145,3251,3252],{"class":158},"key ",[145,3254,1777],{"class":151},[145,3256,159],{"class":158},[145,3258,3165],{"class":151},[145,3260,3261],{"class":174},"66",[145,3263,3264],{"class":158},",",[145,3266,3165],{"class":151},[145,3268,3269],{"class":174},"6f",[145,3271,3264],{"class":158},[145,3273,3165],{"class":151},[145,3275,3276],{"class":174},"72",[145,3278,3264],{"class":158},[145,3280,3165],{"class":151},[145,3282,3283],{"class":174},"67",[145,3285,3264],{"class":158},[145,3287,3165],{"class":151},[145,3289,3290],{"class":174},"69",[145,3292,3264],{"class":158},[145,3294,3165],{"class":151},[145,3296,3297],{"class":174},"76",[145,3299,3264],{"class":158},[145,3301,3165],{"class":151},[145,3303,3304],{"class":174},"65",[145,3306,3264],{"class":158},[145,3308,3165],{"class":151},[145,3310,3311],{"class":174},"6d",[145,3313,3264],{"class":158},[145,3315,3165],{"class":151},[145,3317,3304],{"class":174},[145,3319,3264],{"class":158},[145,3321,3165],{"class":151},[145,3323,3261],{"class":174},[145,3325,3264],{"class":158},[145,3327,3165],{"class":151},[145,3329,3330],{"class":174},"61",[145,3332,3264],{"class":158},[145,3334,3165],{"class":151},[145,3336,3337],{"class":174},"74",[145,3339,3264],{"class":158},[145,3341,3165],{"class":151},[145,3343,3344],{"class":174},"68",[145,3346,3264],{"class":158},[145,3348,3165],{"class":151},[145,3350,3304],{"class":174},[145,3352,3264],{"class":158},[145,3354,3165],{"class":151},[145,3356,3276],{"class":174},[145,3358,3359],{"class":158},"]\n",[145,3361,3362,3365,3368],{"class":147,"line":215},[145,3363,3364],{"class":151},"def",[145,3366,3367],{"class":576}," invert_nibbles",[145,3369,3370],{"class":158},"(b):\n",[145,3372,3373,3375,3378,3380,3382,3385,3387,3389,3391,3393,3395,3397,3399,3402,3404,3406,3408],{"class":147,"line":228},[145,3374,3204],{"class":151},[145,3376,3377],{"class":158}," (b ",[145,3379,1789],{"class":151},[145,3381,1792],{"class":151},[145,3383,3384],{"class":174},"f0",[145,3386,2236],{"class":158},[145,3388,2264],{"class":151},[145,3390,2492],{"class":174},[145,3392,2924],{"class":151},[145,3394,3377],{"class":158},[145,3396,1789],{"class":151},[145,3398,1792],{"class":151},[145,3400,3401],{"class":174},"0f",[145,3403,2236],{"class":158},[145,3405,2489],{"class":151},[145,3407,2492],{"class":174},[145,3409,368],{"class":158},[145,3411,3412],{"class":147,"line":237},[145,3413,241],{"emptyLinePlaceholder":240},[145,3415,3416,3418,3421],{"class":147,"line":244},[145,3417,3364],{"class":151},[145,3419,3420],{"class":576}," main",[145,3422,3423],{"class":158},"():\n",[145,3425,3426,3428,3431,3434,3436,3439],{"class":147,"line":259},[145,3427,1808],{"class":151},[145,3429,3430],{"class":174}," len",[145,3432,3433],{"class":158},"(sys.argv) ",[145,3435,2612],{"class":151},[145,3437,3438],{"class":174}," 2",[145,3440,3441],{"class":158},":\n",[145,3443,3444,3447,3449],{"class":147,"line":270},[145,3445,3446],{"class":158}," sys.exit(",[145,3448,1783],{"class":174},[145,3450,1895],{"class":158},[145,3452,3453],{"class":147,"line":284},[145,3454,241],{"emptyLinePlaceholder":240},[145,3456,3457,3460,3462,3465,3467],{"class":147,"line":301},[145,3458,3459],{"class":158}," pe_path ",[145,3461,1777],{"class":151},[145,3463,3464],{"class":158}," sys.argv[",[145,3466,1783],{"class":174},[145,3468,3359],{"class":158},[145,3470,3471],{"class":147,"line":312},[145,3472,241],{"emptyLinePlaceholder":240},[145,3474,3475,3478],{"class":147,"line":718},[145,3476,3477],{"class":151}," try",[145,3479,3441],{"class":158},[145,3481,3482,3485,3487],{"class":147,"line":731},[145,3483,3484],{"class":158}," pe ",[145,3486,1777],{"class":151},[145,3488,3489],{"class":158}," pefile.PE(pe_path)\n",[145,3491,3492,3495,3498,3501],{"class":147,"line":747},[145,3493,3494],{"class":151}," except",[145,3496,3497],{"class":174}," Exception",[145,3499,3500],{"class":151}," as",[145,3502,3503],{"class":158}," e:\n",[145,3505,3506,3508,3510],{"class":147,"line":769},[145,3507,3446],{"class":158},[145,3509,1783],{"class":174},[145,3511,1895],{"class":158},[145,3513,3514],{"class":147,"line":791},[145,3515,241],{"emptyLinePlaceholder":240},[145,3517,3518,3521,3523],{"class":147,"line":813},[145,3519,3520],{"class":158}," text_section ",[145,3522,1777],{"class":151},[145,3524,3525],{"class":174}," None\n",[145,3527,3528,3531,3534,3537],{"class":147,"line":834},[145,3529,3530],{"class":151}," for",[145,3532,3533],{"class":158}," section ",[145,3535,3536],{"class":151},"in",[145,3538,3539],{"class":158}," pe.sections:\n",[145,3541,3542,3544,3547,3550,3553],{"class":147,"line":855},[145,3543,1832],{"class":151},[145,3545,3546],{"class":151}," b",[145,3548,3549],{"class":2586},"'.text'",[145,3551,3552],{"class":151}," in",[145,3554,3555],{"class":158}," section.Name:\n",[145,3557,3558,3561,3563],{"class":147,"line":877},[145,3559,3560],{"class":158}," text_section ",[145,3562,1777],{"class":151},[145,3564,3565],{"class":158}," section\n",[145,3567,3568],{"class":147,"line":899},[145,3569,3570],{"class":151}," break\n",[145,3572,3573],{"class":147,"line":921},[145,3574,241],{"emptyLinePlaceholder":240},[145,3576,3577,3579,3582,3585,3588],{"class":147,"line":943},[145,3578,1808],{"class":151},[145,3580,3581],{"class":158}," text_section ",[145,3583,3584],{"class":151},"is",[145,3586,3587],{"class":174}," None",[145,3589,3441],{"class":158},[145,3591,3592,3594,3597],{"class":147,"line":965},[145,3593,3446],{"class":158},[145,3595,3596],{"class":174},"2",[145,3598,1895],{"class":158},[145,3600,3601],{"class":147,"line":976},[145,3602,241],{"emptyLinePlaceholder":240},[145,3604,3605,3608,3610,3613],{"class":147,"line":993},[145,3606,3607],{"class":158}," data ",[145,3609,1777],{"class":151},[145,3611,3612],{"class":174}," bytearray",[145,3614,3615],{"class":158},"(text_section.get_data())\n",[145,3617,3618,3621,3623,3626,3629,3631],{"class":147,"line":1012},[145,3619,3620],{"class":158}," pages ",[145,3622,1777],{"class":151},[145,3624,3625],{"class":158}," text_section.SizeOfRawData ",[145,3627,3628],{"class":151},"\u002F\u002F",[145,3630,1792],{"class":151},[145,3632,3633],{"class":174},"1000\n",[145,3635,3636],{"class":147,"line":1031},[145,3637,1569],{"class":158},[145,3639,3640,3642,3645,3647,3650],{"class":147,"line":1050},[145,3641,3530],{"class":151},[145,3643,3644],{"class":158}," i ",[145,3646,3536],{"class":151},[145,3648,3649],{"class":174}," range",[145,3651,3652],{"class":158},"(pages):\n",[145,3654,3655,3658,3660,3662,3664,3666],{"class":147,"line":1069},[145,3656,3657],{"class":158}," offset ",[145,3659,1777],{"class":151},[145,3661,3644],{"class":158},[145,3663,2239],{"class":151},[145,3665,1792],{"class":151},[145,3667,3633],{"class":174},[145,3669,3670,3673,3676,3678,3680,3682,3684,3686],{"class":147,"line":1088},[145,3671,3672],{"class":151}," for",[145,3674,3675],{"class":158}," j ",[145,3677,3536],{"class":151},[145,3679,3649],{"class":174},[145,3681,1817],{"class":158},[145,3683,3165],{"class":151},[145,3685,2744],{"class":174},[145,3687,3688],{"class":158},"):\n",[145,3690,3691,3694,3696,3699,3701,3704,3706],{"class":147,"line":1112},[145,3692,3693],{"class":158}," data[offset ",[145,3695,435],{"class":151},[145,3697,3698],{"class":158}," j] ",[145,3700,1777],{"class":151},[145,3702,3703],{"class":158}," invert_nibbles(data[offset ",[145,3705,435],{"class":151},[145,3707,3708],{"class":158}," j])\n",[145,3710,3711,3713,3715,3717,3720,3723,3726,3728],{"class":147,"line":1134},[145,3712,3693],{"class":158},[145,3714,435],{"class":151},[145,3716,3698],{"class":158},[145,3718,3719],{"class":151},"^=",[145,3721,3722],{"class":158}," key[j ",[145,3724,3725],{"class":151},"%",[145,3727,3430],{"class":174},[145,3729,3730],{"class":158},"(key)]\n",[145,3732,3733],{"class":147,"line":1142},[145,3734,241],{"emptyLinePlaceholder":240},[145,3736,3737,3740,3743],{"class":147,"line":1162},[145,3738,3739],{"class":158}," pe.set_bytes_at_offset(text_section.PointerToRawData, ",[145,3741,3742],{"class":174},"bytes",[145,3744,3745],{"class":158},"(data))\n",[145,3747,3748,3751,3754],{"class":147,"line":1178},[145,3749,3750],{"class":158}," pe.write(",[145,3752,3753],{"class":2586},"'molly_dec.exe'",[145,3755,1895],{"class":158},[145,3757,3758],{"class":147,"line":1197},[145,3759,1803],{"class":158},[145,3761,3762,3764,3767,3770,3773],{"class":147,"line":1216},[145,3763,1735],{"class":151},[145,3765,3766],{"class":174}," __name__",[145,3768,3769],{"class":151}," ==",[145,3771,3772],{"class":2586}," \"__main__\"",[145,3774,3441],{"class":158},[145,3776,3777],{"class":147,"line":1235},[145,3778,3779],{"class":158}," main()\n",[11,3781,3783],{"id":3782},"binary-dynamic-decryption-bonus","Binary Dynamic Decryption (Bonus)",[16,3785,3786,3787,3789],{},"One interesting feature of Molly is its ability to re-encrypt old unlocked pages once the maximum number of decrypted pages has been reached. However, due to the binary’s size and an incorrectly set limit of ",[20,3788,782],{},", Molly allowed 15 pages to remain decrypted, and no re-encryption occurs after the binary exits.",[16,3791,3792],{},[40,3793],{"alt":3794,"src":3795},"encoldpages","\u002Fresources\u002Fmolly\u002Fmolly_encoldpages.png",[16,3797,3798],{},"How can we exploit this behavior?",[16,3800,3801,3802],{},"First, configure x64dbg to establish breakpoints prior to Molly's start and before its termination, and disable the general exception breakpoint.\n",[40,3803],{"alt":3804,"src":3805},"dbg_dumppreparation","\u002Fresources\u002Fmolly\u002Fx64dbg_dump.png",[16,3807,3808,3809],{},"After running Molly, the console should close while the process remains active. Next, open Scylla to dump the process.\n",[40,3810],{"alt":3811,"src":3812},"scylla_dump","\u002Fresources\u002Fmolly\u002FScylla_dump.png",[16,3814,3815],{},"Even if the binary is not fully decrypted, we can still analyze its core components to reconstruct the flag.",[16,3817,3818],{},[40,3819],{"alt":3820,"src":3821},"molly_dump","\u002Fresources\u002Fmolly\u002Fmolly_dump.png",[11,3823,3825],{"id":3824},"binary-analysis","Binary Analysis",[16,3827,3828,3829,195,3832,3835,3836,3839,3840,3843],{},"Upon examining the main function, it becomes clear that Molly compiles and executes a Lua script containing custom functions: ",[20,3830,3831],{},"epic_gaming1",[20,3833,3834],{},"epic_gaming2",", and ",[20,3837,3838],{},"epic_gaming3","; and subsequently defines a global variable ",[20,3841,3842],{},"flag"," with the input provided when running the binary.",[51,3845,3850],{"className":3846,"code":3847,"language":3848,"meta":3849,"style":59},"language-lua shiki shiki-themes github-dark-default","local function a(b)\n local c = {}\n b = b:sub(5, -2)\n for d in string.gmatch(b, \"[^_]+\") do\n table.insert(c, d)\n end\n return c\nend\nlocal function e(f)\n if #f ~= 4 then\n return 1\n end\n local g = 100 + 89 - (84 - 608 \u002F ((945 + 12 + 92 + 65 - 31) \u002F 57) - 23) - 60\n local h = 2370000 \u002F (12 + 93 - 95 \u002F (646 \u002F (85 - 3468 \u002F 68))) \u002F 100 - 52 - 63 - 71\n local i = 149 - (-15 + 8800 \u002F (6248 \u002F (125 - (104 - (17502 \u002F (72 \u002F 12) + 93) \u002F 35 + 36))))\n local j = (52808 \u002F (31 - 1800 \u002F (51 - (95 - 448448 \u002F (147 - 83) \u002F 91) + 42)) - 20) \u002F 66\n if string.char(g, h, i, j) ~= f then\n return 1\n end\n return 0\nend\nlocal k = a(flag) -- split content inside {} by _\nlocal l = epic_gaming2(k[1]) -- run first part check (c side)\nl = l + e(k[2]) -- run second part check (lua side)\nl = l + epic_gaming3(k[3]) -- run third part check (c side)\nl = l + epic_gaming1(k[4]) -- run fourth part check (c side)\nreturn l\n\n","lua","Molly beautified checker script",[20,3851,3852,3866,3879,3904,3927,3935,3940,3947,3952,3964,3982,3989,3993,4074,4149,4233,4317,4335,4341,4345,4352,4356,4373,4396,4418,4441,4463],{"__ignoreMap":59},[145,3853,3854,3857,3860,3863],{"class":147,"line":148},[145,3855,3856],{"class":151},"local",[145,3858,3859],{"class":151}," function",[145,3861,3862],{"class":576}," a",[145,3864,3865],{"class":158},"(b)\n",[145,3867,3868,3871,3874,3876],{"class":147,"line":168},[145,3869,3870],{"class":151}," local",[145,3872,3873],{"class":158}," c ",[145,3875,1777],{"class":151},[145,3877,3878],{"class":158}," {}\n",[145,3880,3881,3884,3886,3888,3890,3892,3894,3896,3898,3900,3902],{"class":147,"line":186},[145,3882,3883],{"class":158}," b ",[145,3885,1777],{"class":151},[145,3887,3546],{"class":2143},[145,3889,136],{"class":158},[145,3891,721],{"class":174},[145,3893,1817],{"class":158},[145,3895,1859],{"class":174},[145,3897,195],{"class":158},[145,3899,677],{"class":151},[145,3901,3596],{"class":174},[145,3903,1895],{"class":158},[145,3905,3906,3908,3911,3913,3916,3919,3922,3924],{"class":147,"line":201},[145,3907,3530],{"class":151},[145,3909,3910],{"class":158}," d ",[145,3912,3536],{"class":151},[145,3914,3915],{"class":174}," string.gmatch",[145,3917,3918],{"class":158},"(b, ",[145,3920,3921],{"class":2586},"\"[^_]+\"",[145,3923,2236],{"class":158},[145,3925,3926],{"class":151},"do\n",[145,3928,3929,3932],{"class":147,"line":215},[145,3930,3931],{"class":174}," table.insert",[145,3933,3934],{"class":158},"(c, d)\n",[145,3936,3937],{"class":147,"line":228},[145,3938,3939],{"class":151}," end\n",[145,3941,3942,3944],{"class":147,"line":237},[145,3943,3204],{"class":151},[145,3945,3946],{"class":158}," c\n",[145,3948,3949],{"class":147,"line":244},[145,3950,3951],{"class":151},"end\n",[145,3953,3954,3956,3958,3961],{"class":147,"line":259},[145,3955,3856],{"class":151},[145,3957,3859],{"class":151},[145,3959,3960],{"class":576}," e",[145,3962,3963],{"class":158},"(f)\n",[145,3965,3966,3968,3971,3974,3977,3979],{"class":147,"line":270},[145,3967,1808],{"class":151},[145,3969,3970],{"class":151}," #",[145,3972,3973],{"class":158},"f ",[145,3975,3976],{"class":151},"~=",[145,3978,2492],{"class":174},[145,3980,3981],{"class":151}," then\n",[145,3983,3984,3986],{"class":147,"line":284},[145,3985,2044],{"class":151},[145,3987,3988],{"class":174}," 1\n",[145,3990,3991],{"class":147,"line":301},[145,3992,3939],{"class":151},[145,3994,3995,3997,4000,4002,4005,4008,4011,4014,4016,4019,4021,4024,4027,4029,4032,4034,4037,4039,4042,4044,4047,4049,4052,4054,4057,4060,4062,4064,4067,4069,4071],{"class":147,"line":312},[145,3996,3870],{"class":151},[145,3998,3999],{"class":158}," g ",[145,4001,1777],{"class":151},[145,4003,4004],{"class":174}," 100",[145,4006,4007],{"class":151}," +",[145,4009,4010],{"class":174}," 89",[145,4012,4013],{"class":151}," -",[145,4015,1811],{"class":158},[145,4017,4018],{"class":174},"84",[145,4020,4013],{"class":151},[145,4022,4023],{"class":174}," 608",[145,4025,4026],{"class":151}," \u002F",[145,4028,2449],{"class":158},[145,4030,4031],{"class":174},"945",[145,4033,4007],{"class":151},[145,4035,4036],{"class":174}," 12",[145,4038,4007],{"class":151},[145,4040,4041],{"class":174}," 92",[145,4043,4007],{"class":151},[145,4045,4046],{"class":174}," 65",[145,4048,4013],{"class":151},[145,4050,4051],{"class":174}," 31",[145,4053,2236],{"class":158},[145,4055,4056],{"class":151},"\u002F",[145,4058,4059],{"class":174}," 57",[145,4061,2236],{"class":158},[145,4063,677],{"class":151},[145,4065,4066],{"class":174}," 23",[145,4068,2236],{"class":158},[145,4070,677],{"class":151},[145,4072,4073],{"class":174}," 60\n",[145,4075,4076,4078,4081,4083,4086,4088,4090,4093,4095,4098,4100,4103,4105,4107,4110,4112,4114,4117,4119,4122,4124,4127,4130,4132,4134,4136,4139,4141,4144,4146],{"class":147,"line":718},[145,4077,3870],{"class":151},[145,4079,4080],{"class":158}," h ",[145,4082,1777],{"class":151},[145,4084,4085],{"class":174}," 2370000",[145,4087,4026],{"class":151},[145,4089,1811],{"class":158},[145,4091,4092],{"class":174},"12",[145,4094,4007],{"class":151},[145,4096,4097],{"class":174}," 93",[145,4099,4013],{"class":151},[145,4101,4102],{"class":174}," 95",[145,4104,4026],{"class":151},[145,4106,1811],{"class":158},[145,4108,4109],{"class":174},"646",[145,4111,4026],{"class":151},[145,4113,1811],{"class":158},[145,4115,4116],{"class":174},"85",[145,4118,4013],{"class":151},[145,4120,4121],{"class":174}," 3468",[145,4123,4026],{"class":151},[145,4125,4126],{"class":174}," 68",[145,4128,4129],{"class":158},"))) ",[145,4131,4056],{"class":151},[145,4133,4004],{"class":174},[145,4135,4013],{"class":151},[145,4137,4138],{"class":174}," 52",[145,4140,4013],{"class":151},[145,4142,4143],{"class":174}," 63",[145,4145,4013],{"class":151},[145,4147,4148],{"class":174}," 71\n",[145,4150,4151,4153,4155,4157,4160,4162,4164,4166,4169,4171,4174,4176,4178,4181,4183,4185,4188,4190,4192,4195,4197,4199,4202,4204,4206,4208,4210,4212,4214,4216,4218,4220,4222,4225,4227,4230],{"class":147,"line":731},[145,4152,3870],{"class":151},[145,4154,3644],{"class":158},[145,4156,1777],{"class":151},[145,4158,4159],{"class":174}," 149",[145,4161,4013],{"class":151},[145,4163,1811],{"class":158},[145,4165,677],{"class":151},[145,4167,4168],{"class":174},"15",[145,4170,4007],{"class":151},[145,4172,4173],{"class":174}," 8800",[145,4175,4026],{"class":151},[145,4177,1811],{"class":158},[145,4179,4180],{"class":174},"6248",[145,4182,4026],{"class":151},[145,4184,1811],{"class":158},[145,4186,4187],{"class":174},"125",[145,4189,4013],{"class":151},[145,4191,1811],{"class":158},[145,4193,4194],{"class":174},"104",[145,4196,4013],{"class":151},[145,4198,1811],{"class":158},[145,4200,4201],{"class":174},"17502",[145,4203,4026],{"class":151},[145,4205,1811],{"class":158},[145,4207,3276],{"class":174},[145,4209,4026],{"class":151},[145,4211,4036],{"class":174},[145,4213,2236],{"class":158},[145,4215,435],{"class":151},[145,4217,4097],{"class":174},[145,4219,2236],{"class":158},[145,4221,4056],{"class":151},[145,4223,4224],{"class":174}," 35",[145,4226,4007],{"class":151},[145,4228,4229],{"class":174}," 36",[145,4231,4232],{"class":158},"))))\n",[145,4234,4235,4237,4239,4241,4243,4246,4248,4250,4253,4255,4258,4260,4262,4265,4267,4269,4272,4274,4277,4279,4281,4284,4286,4289,4291,4293,4296,4298,4300,4303,4305,4307,4310,4312,4314],{"class":147,"line":747},[145,4236,3870],{"class":151},[145,4238,3675],{"class":158},[145,4240,1777],{"class":151},[145,4242,1811],{"class":158},[145,4244,4245],{"class":174},"52808",[145,4247,4026],{"class":151},[145,4249,1811],{"class":158},[145,4251,4252],{"class":174},"31",[145,4254,4013],{"class":151},[145,4256,4257],{"class":174}," 1800",[145,4259,4026],{"class":151},[145,4261,1811],{"class":158},[145,4263,4264],{"class":174},"51",[145,4266,4013],{"class":151},[145,4268,1811],{"class":158},[145,4270,4271],{"class":174},"95",[145,4273,4013],{"class":151},[145,4275,4276],{"class":174}," 448448",[145,4278,4026],{"class":151},[145,4280,1811],{"class":158},[145,4282,4283],{"class":174},"147",[145,4285,4013],{"class":151},[145,4287,4288],{"class":174}," 83",[145,4290,2236],{"class":158},[145,4292,4056],{"class":151},[145,4294,4295],{"class":174}," 91",[145,4297,2236],{"class":158},[145,4299,435],{"class":151},[145,4301,4302],{"class":174}," 42",[145,4304,2270],{"class":158},[145,4306,677],{"class":151},[145,4308,4309],{"class":174}," 20",[145,4311,2236],{"class":158},[145,4313,4056],{"class":151},[145,4315,4316],{"class":174}," 66\n",[145,4318,4319,4321,4324,4327,4329,4332],{"class":147,"line":769},[145,4320,1808],{"class":151},[145,4322,4323],{"class":174}," string.char",[145,4325,4326],{"class":158},"(g, h, i, j) ",[145,4328,3976],{"class":151},[145,4330,4331],{"class":158}," f ",[145,4333,4334],{"class":151},"then\n",[145,4336,4337,4339],{"class":147,"line":791},[145,4338,2044],{"class":151},[145,4340,3988],{"class":174},[145,4342,4343],{"class":147,"line":813},[145,4344,3939],{"class":151},[145,4346,4347,4349],{"class":147,"line":834},[145,4348,3204],{"class":151},[145,4350,4351],{"class":174}," 0\n",[145,4353,4354],{"class":147,"line":855},[145,4355,3951],{"class":151},[145,4357,4358,4360,4363,4365,4367,4370],{"class":147,"line":877},[145,4359,3856],{"class":151},[145,4361,4362],{"class":158}," k ",[145,4364,1777],{"class":151},[145,4366,3862],{"class":174},[145,4368,4369],{"class":158},"(flag) ",[145,4371,4372],{"class":1867},"-- split content inside {} by _\n",[145,4374,4375,4377,4380,4382,4385,4388,4390,4393],{"class":147,"line":899},[145,4376,3856],{"class":151},[145,4378,4379],{"class":158}," l ",[145,4381,1777],{"class":151},[145,4383,4384],{"class":174}," epic_gaming2",[145,4386,4387],{"class":158},"(k[",[145,4389,1783],{"class":174},[145,4391,4392],{"class":158},"]) ",[145,4394,4395],{"class":1867},"-- run first part check (c side)\n",[145,4397,4398,4401,4403,4405,4407,4409,4411,4413,4415],{"class":147,"line":921},[145,4399,4400],{"class":158},"l ",[145,4402,1777],{"class":151},[145,4404,4379],{"class":158},[145,4406,435],{"class":151},[145,4408,3960],{"class":174},[145,4410,4387],{"class":158},[145,4412,3596],{"class":174},[145,4414,4392],{"class":158},[145,4416,4417],{"class":1867},"-- run second part check (lua side)\n",[145,4419,4420,4422,4424,4426,4428,4431,4433,4436,4438],{"class":147,"line":943},[145,4421,4400],{"class":158},[145,4423,1777],{"class":151},[145,4425,4379],{"class":158},[145,4427,435],{"class":151},[145,4429,4430],{"class":174}," epic_gaming3",[145,4432,4387],{"class":158},[145,4434,4435],{"class":174},"3",[145,4437,4392],{"class":158},[145,4439,4440],{"class":1867},"-- run third part check (c side)\n",[145,4442,4443,4445,4447,4449,4451,4454,4456,4458,4460],{"class":147,"line":965},[145,4444,4400],{"class":158},[145,4446,1777],{"class":151},[145,4448,4379],{"class":158},[145,4450,435],{"class":151},[145,4452,4453],{"class":174}," epic_gaming1",[145,4455,4387],{"class":158},[145,4457,2797],{"class":174},[145,4459,4392],{"class":158},[145,4461,4462],{"class":1867},"-- run fourth part check (c side)\n",[145,4464,4465,4467],{"class":147,"line":976},[145,4466,2068],{"class":151},[145,4468,4469],{"class":158}," l\n",[51,4471,4474],{"className":1725,"code":4472,"language":1727,"meta":4473,"style":59},"__int64 __fastcall epic_gaming2(__int64 a1)\n{\n \u002F\u002F ...\n if ( v3 == 7 )\n {\n *(_DWORD *)v10 = 0xEFBEADDE;\n *(_QWORD *)v11 = 0x8DD4BC8B8E9DE8LL;\n v4 = v11;\n v5 = 0;\n v6 = v2 - (_QWORD)v11;\n while ( 1 )\n {\n v7 = v4[v6];\n *v4 ^= v10[v5 & 3];\n\u002F\u002F ...\n return 1LL;\n}\n","epic_gaming2 logic",[20,4475,4476,4491,4495,4500,4516,4521,4543,4567,4577,4588,4603,4615,4619,4632,4654,4659,4670],{"__ignoreMap":59},[145,4477,4478,4481,4483,4486,4489],{"class":147,"line":148},[145,4479,4480],{"class":158},"__int64 __fastcall ",[145,4482,3834],{"class":576},[145,4484,4485],{"class":158},"(__int64 ",[145,4487,4488],{"class":2143},"a1",[145,4490,1895],{"class":158},[145,4492,4493],{"class":147,"line":168},[145,4494,1766],{"class":158},[145,4496,4497],{"class":147,"line":186},[145,4498,4499],{"class":1867}," \u002F\u002F ...\n",[145,4501,4502,4505,4508,4510,4513],{"class":147,"line":201},[145,4503,4504],{"class":151}," if",[145,4506,4507],{"class":158}," ( v3 ",[145,4509,1747],{"class":151},[145,4511,4512],{"class":174}," 7",[145,4514,4515],{"class":158}," )\n",[145,4517,4518],{"class":147,"line":215},[145,4519,4520],{"class":158}," {\n",[145,4522,4523,4526,4529,4531,4534,4536,4538,4541],{"class":147,"line":228},[145,4524,4525],{"class":151}," *",[145,4527,4528],{"class":158},"(_DWORD ",[145,4530,2239],{"class":151},[145,4532,4533],{"class":158},")v10 ",[145,4535,1777],{"class":151},[145,4537,1792],{"class":151},[145,4539,4540],{"class":174},"EFBEADDE",[145,4542,1798],{"class":158},[145,4544,4545,4547,4550,4552,4555,4557,4559,4562,4565],{"class":147,"line":237},[145,4546,4525],{"class":151},[145,4548,4549],{"class":158},"(_QWORD ",[145,4551,2239],{"class":151},[145,4553,4554],{"class":158},")v11 ",[145,4556,1777],{"class":151},[145,4558,1792],{"class":151},[145,4560,4561],{"class":174},"8DD4BC8B8E9DE8",[145,4563,4564],{"class":151},"LL",[145,4566,1798],{"class":158},[145,4568,4569,4572,4574],{"class":147,"line":244},[145,4570,4571],{"class":158}," v4 ",[145,4573,1777],{"class":151},[145,4575,4576],{"class":158}," v11;\n",[145,4578,4579,4582,4584,4586],{"class":147,"line":259},[145,4580,4581],{"class":158}," v5 ",[145,4583,1777],{"class":151},[145,4585,1990],{"class":174},[145,4587,1798],{"class":158},[145,4589,4590,4593,4595,4598,4600],{"class":147,"line":270},[145,4591,4592],{"class":158}," v6 ",[145,4594,1777],{"class":151},[145,4596,4597],{"class":158}," v2 ",[145,4599,677],{"class":151},[145,4601,4602],{"class":158}," (_QWORD)v11;\n",[145,4604,4605,4608,4611,4613],{"class":147,"line":284},[145,4606,4607],{"class":151}," while",[145,4609,4610],{"class":158}," ( ",[145,4612,1783],{"class":174},[145,4614,4515],{"class":158},[145,4616,4617],{"class":147,"line":301},[145,4618,1827],{"class":158},[145,4620,4621,4624,4626,4629],{"class":147,"line":312},[145,4622,4623],{"class":158}," v7 ",[145,4625,1777],{"class":151},[145,4627,4628],{"class":2143}," v4",[145,4630,4631],{"class":158},"[v6];\n",[145,4633,4634,4637,4640,4642,4645,4648,4650,4652],{"class":147,"line":718},[145,4635,4636],{"class":151}," *",[145,4638,4639],{"class":158},"v4 ",[145,4641,3719],{"class":151},[145,4643,4644],{"class":2143}," v10",[145,4646,4647],{"class":158},"[v5 ",[145,4649,1789],{"class":151},[145,4651,3061],{"class":174},[145,4653,2535],{"class":158},[145,4655,4656],{"class":147,"line":731},[145,4657,4658],{"class":1867},"\u002F\u002F ...\n",[145,4660,4661,4664,4666,4668],{"class":147,"line":747},[145,4662,4663],{"class":151}," return",[145,4665,2891],{"class":174},[145,4667,4564],{"class":151},[145,4669,1798],{"class":158},[145,4671,4672],{"class":147,"line":769},[145,4673,487],{"class":158},[51,4675,4678],{"className":3224,"code":4676,"language":3226,"meta":4677,"style":59},"# epic_gaming2 solve\nxored = b\"\\xe8\\x9d\\x8e\\x8b\\xbc\\xd4\\x8d\"\nkey = [ 0xDE, 0xAD, 0xBE, 0xEF ]\n\npart1 = [ xored[i] ^ key[i % len(key)] for i in range(len(xored)) ]\n \nprint(''.join([chr(c) for c in part1])) # 600dby3\n","epic_gaming2 solve",[20,4679,4680,4685,4703,4741,4745,4784,4788],{"__ignoreMap":59},[145,4681,4682],{"class":147,"line":148},[145,4683,4684],{"class":1867},"# epic_gaming2 solve\n",[145,4686,4687,4690,4692,4694,4697,4700],{"class":147,"line":168},[145,4688,4689],{"class":158},"xored ",[145,4691,1777],{"class":151},[145,4693,3546],{"class":151},[145,4695,4696],{"class":2586},"\"",[145,4698,4699],{"class":151},"\\xe8\\x9d\\x8e\\x8b\\xbc\\xd4\\x8d",[145,4701,4702],{"class":2586},"\"\n",[145,4704,4705,4707,4709,4712,4714,4717,4719,4721,4724,4726,4728,4731,4733,4735,4738],{"class":147,"line":186},[145,4706,3252],{"class":158},[145,4708,1777],{"class":151},[145,4710,4711],{"class":158}," [ ",[145,4713,3165],{"class":151},[145,4715,4716],{"class":174},"DE",[145,4718,195],{"class":158},[145,4720,3165],{"class":151},[145,4722,4723],{"class":174},"AD",[145,4725,195],{"class":158},[145,4727,3165],{"class":151},[145,4729,4730],{"class":174},"BE",[145,4732,195],{"class":158},[145,4734,3165],{"class":151},[145,4736,4737],{"class":174},"EF",[145,4739,4740],{"class":158}," ]\n",[145,4742,4743],{"class":147,"line":201},[145,4744,241],{"emptyLinePlaceholder":240},[145,4746,4747,4750,4752,4755,4757,4760,4762,4764,4767,4770,4772,4774,4776,4778,4781],{"class":147,"line":215},[145,4748,4749],{"class":158},"part1 ",[145,4751,1777],{"class":151},[145,4753,4754],{"class":158}," [ xored[i] ",[145,4756,2228],{"class":151},[145,4758,4759],{"class":158}," key[i ",[145,4761,3725],{"class":151},[145,4763,3430],{"class":174},[145,4765,4766],{"class":158},"(key)] ",[145,4768,4769],{"class":151},"for",[145,4771,3644],{"class":158},[145,4773,3536],{"class":151},[145,4775,3649],{"class":174},[145,4777,1817],{"class":158},[145,4779,4780],{"class":174},"len",[145,4782,4783],{"class":158},"(xored)) ]\n",[145,4785,4786],{"class":147,"line":228},[145,4787,1803],{"class":158},[145,4789,4790,4793,4795,4798,4801,4804,4807,4809,4811,4813,4816],{"class":147,"line":237},[145,4791,4792],{"class":174},"print",[145,4794,1817],{"class":158},[145,4796,4797],{"class":2586},"''",[145,4799,4800],{"class":158},".join([",[145,4802,4803],{"class":174},"chr",[145,4805,4806],{"class":158},"(c) ",[145,4808,4769],{"class":151},[145,4810,3873],{"class":158},[145,4812,3536],{"class":151},[145,4814,4815],{"class":158}," part1])) ",[145,4817,4818],{"class":1867},"# 600dby3\n",[2100,4820,4821],{},[16,4822,4823],{},[20,4824,4825],{},"600dby3",[51,4827,4830],{"className":3846,"code":4828,"language":3848,"meta":4829,"style":59},"local g = 100 + 89 - (84 - 608 \u002F ((945 + 12 + 92 + 65 - 31) \u002F 57) - 23) - 60\nlocal h = 2370000 \u002F (12 + 93 - 95 \u002F (646 \u002F (85 - 3468 \u002F 68))) \u002F 100 - 52 - 63 - 71\nlocal i = 149 - (-15 + 8800 \u002F (6248 \u002F (125 - (104 - (17502 \u002F (72 \u002F 12) + 93) \u002F 35 + 36))))\nlocal j = (52808 \u002F (31 - 1800 \u002F (51 - (95 - 448448 \u002F (147 - 83) \u002F 91) + 42)) - 20) \u002F 66\nprint(string.char(g, h, i, j))\n","lua func solve",[20,4831,4832,4896,4958,5032,5104],{"__ignoreMap":59},[145,4833,4834,4836,4838,4840,4842,4844,4846,4848,4850,4852,4854,4856,4858,4860,4862,4864,4866,4868,4870,4872,4874,4876,4878,4880,4882,4884,4886,4888,4890,4892,4894],{"class":147,"line":148},[145,4835,3856],{"class":151},[145,4837,3999],{"class":158},[145,4839,1777],{"class":151},[145,4841,4004],{"class":174},[145,4843,4007],{"class":151},[145,4845,4010],{"class":174},[145,4847,4013],{"class":151},[145,4849,1811],{"class":158},[145,4851,4018],{"class":174},[145,4853,4013],{"class":151},[145,4855,4023],{"class":174},[145,4857,4026],{"class":151},[145,4859,2449],{"class":158},[145,4861,4031],{"class":174},[145,4863,4007],{"class":151},[145,4865,4036],{"class":174},[145,4867,4007],{"class":151},[145,4869,4041],{"class":174},[145,4871,4007],{"class":151},[145,4873,4046],{"class":174},[145,4875,4013],{"class":151},[145,4877,4051],{"class":174},[145,4879,2236],{"class":158},[145,4881,4056],{"class":151},[145,4883,4059],{"class":174},[145,4885,2236],{"class":158},[145,4887,677],{"class":151},[145,4889,4066],{"class":174},[145,4891,2236],{"class":158},[145,4893,677],{"class":151},[145,4895,4073],{"class":174},[145,4897,4898,4900,4902,4904,4906,4908,4910,4912,4914,4916,4918,4920,4922,4924,4926,4928,4930,4932,4934,4936,4938,4940,4942,4944,4946,4948,4950,4952,4954,4956],{"class":147,"line":168},[145,4899,3856],{"class":151},[145,4901,4080],{"class":158},[145,4903,1777],{"class":151},[145,4905,4085],{"class":174},[145,4907,4026],{"class":151},[145,4909,1811],{"class":158},[145,4911,4092],{"class":174},[145,4913,4007],{"class":151},[145,4915,4097],{"class":174},[145,4917,4013],{"class":151},[145,4919,4102],{"class":174},[145,4921,4026],{"class":151},[145,4923,1811],{"class":158},[145,4925,4109],{"class":174},[145,4927,4026],{"class":151},[145,4929,1811],{"class":158},[145,4931,4116],{"class":174},[145,4933,4013],{"class":151},[145,4935,4121],{"class":174},[145,4937,4026],{"class":151},[145,4939,4126],{"class":174},[145,4941,4129],{"class":158},[145,4943,4056],{"class":151},[145,4945,4004],{"class":174},[145,4947,4013],{"class":151},[145,4949,4138],{"class":174},[145,4951,4013],{"class":151},[145,4953,4143],{"class":174},[145,4955,4013],{"class":151},[145,4957,4148],{"class":174},[145,4959,4960,4962,4964,4966,4968,4970,4972,4974,4976,4978,4980,4982,4984,4986,4988,4990,4992,4994,4996,4998,5000,5002,5004,5006,5008,5010,5012,5014,5016,5018,5020,5022,5024,5026,5028,5030],{"class":147,"line":186},[145,4961,3856],{"class":151},[145,4963,3644],{"class":158},[145,4965,1777],{"class":151},[145,4967,4159],{"class":174},[145,4969,4013],{"class":151},[145,4971,1811],{"class":158},[145,4973,677],{"class":151},[145,4975,4168],{"class":174},[145,4977,4007],{"class":151},[145,4979,4173],{"class":174},[145,4981,4026],{"class":151},[145,4983,1811],{"class":158},[145,4985,4180],{"class":174},[145,4987,4026],{"class":151},[145,4989,1811],{"class":158},[145,4991,4187],{"class":174},[145,4993,4013],{"class":151},[145,4995,1811],{"class":158},[145,4997,4194],{"class":174},[145,4999,4013],{"class":151},[145,5001,1811],{"class":158},[145,5003,4201],{"class":174},[145,5005,4026],{"class":151},[145,5007,1811],{"class":158},[145,5009,3276],{"class":174},[145,5011,4026],{"class":151},[145,5013,4036],{"class":174},[145,5015,2236],{"class":158},[145,5017,435],{"class":151},[145,5019,4097],{"class":174},[145,5021,2236],{"class":158},[145,5023,4056],{"class":151},[145,5025,4224],{"class":174},[145,5027,4007],{"class":151},[145,5029,4229],{"class":174},[145,5031,4232],{"class":158},[145,5033,5034,5036,5038,5040,5042,5044,5046,5048,5050,5052,5054,5056,5058,5060,5062,5064,5066,5068,5070,5072,5074,5076,5078,5080,5082,5084,5086,5088,5090,5092,5094,5096,5098,5100,5102],{"class":147,"line":201},[145,5035,3856],{"class":151},[145,5037,3675],{"class":158},[145,5039,1777],{"class":151},[145,5041,1811],{"class":158},[145,5043,4245],{"class":174},[145,5045,4026],{"class":151},[145,5047,1811],{"class":158},[145,5049,4252],{"class":174},[145,5051,4013],{"class":151},[145,5053,4257],{"class":174},[145,5055,4026],{"class":151},[145,5057,1811],{"class":158},[145,5059,4264],{"class":174},[145,5061,4013],{"class":151},[145,5063,1811],{"class":158},[145,5065,4271],{"class":174},[145,5067,4013],{"class":151},[145,5069,4276],{"class":174},[145,5071,4026],{"class":151},[145,5073,1811],{"class":158},[145,5075,4283],{"class":174},[145,5077,4013],{"class":151},[145,5079,4288],{"class":174},[145,5081,2236],{"class":158},[145,5083,4056],{"class":151},[145,5085,4295],{"class":174},[145,5087,2236],{"class":158},[145,5089,435],{"class":151},[145,5091,4302],{"class":174},[145,5093,2270],{"class":158},[145,5095,677],{"class":151},[145,5097,4309],{"class":174},[145,5099,2236],{"class":158},[145,5101,4056],{"class":151},[145,5103,4316],{"class":174},[145,5105,5106,5108,5110,5113],{"class":147,"line":215},[145,5107,4792],{"class":174},[145,5109,1817],{"class":158},[145,5111,5112],{"class":174},"string.char",[145,5114,5115],{"class":158},"(g, h, i, j))\n",[2100,5117,5118],{},[16,5119,5120],{},[20,5121,5122],{},"d3@r",[51,5124,5126],{"className":1725,"code":5125,"language":1727,"meta":3838,"style":59},"&& ((unsigned __int16)v2[1] | (unsigned __int16)(*v2 \u003C\u003C 8)) == COERCE_INT('0p')\n && ((unsigned __int16)v2[3] | (unsigned __int16)(v2[2] \u003C\u003C 8)) == COERCE_INT('3n')\n && ((unsigned __int16)v2[5] | (unsigned __int16)(v2[4] \u003C\u003C 8)) == COERCE_INT('50')\n && ((unsigned __int16)v2[7] | (unsigned __int16)(v2[6] \u003C\u003C 8)) == COERCE_INT('ur')\n && ((unsigned __int16)v2[9] | (unsigned __int16)(v2[8] \u003C\u003C 8)) == COERCE_INT('c3') )\n",[20,5127,5128,5182,5234,5285,5337],{"__ignoreMap":59},[145,5129,5130,5132,5134,5137,5140,5143,5145,5147,5149,5152,5154,5156,5159,5161,5164,5166,5168,5170,5172,5175,5177,5180],{"class":147,"line":148},[145,5131,1753],{"class":151},[145,5133,2449],{"class":158},[145,5135,5136],{"class":151},"unsigned",[145,5138,5139],{"class":158}," __int16)",[145,5141,5142],{"class":2143},"v2",[145,5144,2530],{"class":158},[145,5146,1783],{"class":174},[145,5148,1786],{"class":158},[145,5150,5151],{"class":151},"|",[145,5153,1811],{"class":158},[145,5155,5136],{"class":151},[145,5157,5158],{"class":158}," __int16)(",[145,5160,2239],{"class":151},[145,5162,5163],{"class":158},"v2 ",[145,5165,2489],{"class":151},[145,5167,2267],{"class":174},[145,5169,2270],{"class":158},[145,5171,1747],{"class":151},[145,5173,5174],{"class":576}," COERCE_INT",[145,5176,1817],{"class":158},[145,5178,5179],{"class":2586},"'0p'",[145,5181,1895],{"class":158},[145,5183,5184,5187,5189,5191,5193,5195,5197,5199,5201,5203,5205,5207,5209,5211,5213,5215,5217,5219,5221,5223,5225,5227,5229,5232],{"class":147,"line":168},[145,5185,5186],{"class":151}," &&",[145,5188,2449],{"class":158},[145,5190,5136],{"class":151},[145,5192,5139],{"class":158},[145,5194,5142],{"class":2143},[145,5196,2530],{"class":158},[145,5198,4435],{"class":174},[145,5200,1786],{"class":158},[145,5202,5151],{"class":151},[145,5204,1811],{"class":158},[145,5206,5136],{"class":151},[145,5208,5158],{"class":158},[145,5210,5142],{"class":2143},[145,5212,2530],{"class":158},[145,5214,3596],{"class":174},[145,5216,1786],{"class":158},[145,5218,2489],{"class":151},[145,5220,2267],{"class":174},[145,5222,2270],{"class":158},[145,5224,1747],{"class":151},[145,5226,5174],{"class":576},[145,5228,1817],{"class":158},[145,5230,5231],{"class":2586},"'3n'",[145,5233,1895],{"class":158},[145,5235,5236,5238,5240,5242,5244,5246,5248,5250,5252,5254,5256,5258,5260,5262,5264,5266,5268,5270,5272,5274,5276,5278,5280,5283],{"class":147,"line":186},[145,5237,5186],{"class":151},[145,5239,2449],{"class":158},[145,5241,5136],{"class":151},[145,5243,5139],{"class":158},[145,5245,5142],{"class":2143},[145,5247,2530],{"class":158},[145,5249,1859],{"class":174},[145,5251,1786],{"class":158},[145,5253,5151],{"class":151},[145,5255,1811],{"class":158},[145,5257,5136],{"class":151},[145,5259,5158],{"class":158},[145,5261,5142],{"class":2143},[145,5263,2530],{"class":158},[145,5265,2797],{"class":174},[145,5267,1786],{"class":158},[145,5269,2489],{"class":151},[145,5271,2267],{"class":174},[145,5273,2270],{"class":158},[145,5275,1747],{"class":151},[145,5277,5174],{"class":576},[145,5279,1817],{"class":158},[145,5281,5282],{"class":2586},"'50'",[145,5284,1895],{"class":158},[145,5286,5287,5289,5291,5293,5295,5297,5299,5302,5304,5306,5308,5310,5312,5314,5316,5318,5320,5322,5324,5326,5328,5330,5332,5335],{"class":147,"line":201},[145,5288,5186],{"class":151},[145,5290,2449],{"class":158},[145,5292,5136],{"class":151},[145,5294,5139],{"class":158},[145,5296,5142],{"class":2143},[145,5298,2530],{"class":158},[145,5300,5301],{"class":174},"7",[145,5303,1786],{"class":158},[145,5305,5151],{"class":151},[145,5307,1811],{"class":158},[145,5309,5136],{"class":151},[145,5311,5158],{"class":158},[145,5313,5142],{"class":2143},[145,5315,2530],{"class":158},[145,5317,1922],{"class":174},[145,5319,1786],{"class":158},[145,5321,2489],{"class":151},[145,5323,2267],{"class":174},[145,5325,2270],{"class":158},[145,5327,1747],{"class":151},[145,5329,5174],{"class":576},[145,5331,1817],{"class":158},[145,5333,5334],{"class":2586},"'ur'",[145,5336,1895],{"class":158},[145,5338,5339,5341,5343,5345,5347,5349,5351,5354,5356,5358,5360,5362,5364,5366,5368,5371,5373,5375,5377,5379,5381,5383,5385,5388],{"class":147,"line":215},[145,5340,5186],{"class":151},[145,5342,2449],{"class":158},[145,5344,5136],{"class":151},[145,5346,5139],{"class":158},[145,5348,5142],{"class":2143},[145,5350,2530],{"class":158},[145,5352,5353],{"class":174},"9",[145,5355,1786],{"class":158},[145,5357,5151],{"class":151},[145,5359,1811],{"class":158},[145,5361,5136],{"class":151},[145,5363,5158],{"class":158},[145,5365,5142],{"class":2143},[145,5367,2530],{"class":158},[145,5369,5370],{"class":174},"8",[145,5372,1786],{"class":158},[145,5374,2489],{"class":151},[145,5376,2267],{"class":174},[145,5378,2270],{"class":158},[145,5380,1747],{"class":151},[145,5382,5174],{"class":576},[145,5384,1817],{"class":158},[145,5386,5387],{"class":2586},"'c3'",[145,5389,5390],{"class":158},") )\n",[2100,5392,5393],{},[16,5394,5395],{},[20,5396,5397],{},"0p3n50urc3",[51,5399,5401],{"className":3224,"code":5400,"language":3226,"meta":3831,"style":59},"text = \"0n0_d@y_w3_w1ll_m33t\"\ntext += \" \" * (44 - len(text))\npart2_c = [0, 182, 260, 429, 796, 680, 1188, 1043, 1560, 1548, 1520, 2618, 1656, 2548, 2604, 2145, 3184, 2346, 2250, 4332, 2600, 2877, 1870, 3174, 3120, 2050, 2080, 4050, 3668, 4089, 3060, 2573, 3456, 2673, 3876, 4270, 4716, 2960, 4180, 4212, 4400, 4141, 6216, 3612]\nprint(part2_c[:44])\npart2 = \"\"\n\nfrom string import printable\nfor i in range(1, 44):\n sum = part2_c[i] \u002F i\n for c in printable:\n if ord(c) + ord(text[i]) == sum:\n part2 += c\n break\n\n# aHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3L1RZc0NLNEt4 => base64 => \"https...\"\npart2 = \"a\" + part2 \nprint(part2)\n",[20,5402,5403,5413,5436,5665,5677,5687,5691,5704,5724,5740,5751,5774,5783,5787,5791,5796,5810],{"__ignoreMap":59},[145,5404,5405,5408,5410],{"class":147,"line":148},[145,5406,5407],{"class":158},"text ",[145,5409,1777],{"class":151},[145,5411,5412],{"class":2586}," \"0n0_d@y_w3_w1ll_m33t\"\n",[145,5414,5415,5417,5419,5422,5424,5426,5429,5431,5433],{"class":147,"line":168},[145,5416,5407],{"class":158},[145,5418,2888],{"class":151},[145,5420,5421],{"class":2586}," \" \"",[145,5423,2499],{"class":151},[145,5425,1811],{"class":158},[145,5427,5428],{"class":174},"44",[145,5430,4013],{"class":151},[145,5432,3430],{"class":174},[145,5434,5435],{"class":158},"(text))\n",[145,5437,5438,5441,5443,5445,5448,5450,5453,5455,5458,5460,5463,5465,5468,5470,5473,5475,5478,5480,5483,5485,5488,5490,5493,5495,5498,5500,5503,5505,5508,5510,5513,5515,5518,5520,5523,5525,5528,5530,5533,5535,5538,5540,5543,5545,5548,5550,5553,5555,5558,5560,5563,5565,5568,5570,5573,5575,5578,5580,5583,5585,5588,5590,5593,5595,5598,5600,5603,5605,5608,5610,5613,5615,5618,5620,5623,5625,5628,5630,5633,5635,5638,5640,5643,5645,5648,5650,5653,5655,5658,5660,5663],{"class":147,"line":186},[145,5439,5440],{"class":158},"part2_c ",[145,5442,1777],{"class":151},[145,5444,159],{"class":158},[145,5446,5447],{"class":174},"0",[145,5449,195],{"class":158},[145,5451,5452],{"class":174},"182",[145,5454,195],{"class":158},[145,5456,5457],{"class":174},"260",[145,5459,195],{"class":158},[145,5461,5462],{"class":174},"429",[145,5464,195],{"class":158},[145,5466,5467],{"class":174},"796",[145,5469,195],{"class":158},[145,5471,5472],{"class":174},"680",[145,5474,195],{"class":158},[145,5476,5477],{"class":174},"1188",[145,5479,195],{"class":158},[145,5481,5482],{"class":174},"1043",[145,5484,195],{"class":158},[145,5486,5487],{"class":174},"1560",[145,5489,195],{"class":158},[145,5491,5492],{"class":174},"1548",[145,5494,195],{"class":158},[145,5496,5497],{"class":174},"1520",[145,5499,195],{"class":158},[145,5501,5502],{"class":174},"2618",[145,5504,195],{"class":158},[145,5506,5507],{"class":174},"1656",[145,5509,195],{"class":158},[145,5511,5512],{"class":174},"2548",[145,5514,195],{"class":158},[145,5516,5517],{"class":174},"2604",[145,5519,195],{"class":158},[145,5521,5522],{"class":174},"2145",[145,5524,195],{"class":158},[145,5526,5527],{"class":174},"3184",[145,5529,195],{"class":158},[145,5531,5532],{"class":174},"2346",[145,5534,195],{"class":158},[145,5536,5537],{"class":174},"2250",[145,5539,195],{"class":158},[145,5541,5542],{"class":174},"4332",[145,5544,195],{"class":158},[145,5546,5547],{"class":174},"2600",[145,5549,195],{"class":158},[145,5551,5552],{"class":174},"2877",[145,5554,195],{"class":158},[145,5556,5557],{"class":174},"1870",[145,5559,195],{"class":158},[145,5561,5562],{"class":174},"3174",[145,5564,195],{"class":158},[145,5566,5567],{"class":174},"3120",[145,5569,195],{"class":158},[145,5571,5572],{"class":174},"2050",[145,5574,195],{"class":158},[145,5576,5577],{"class":174},"2080",[145,5579,195],{"class":158},[145,5581,5582],{"class":174},"4050",[145,5584,195],{"class":158},[145,5586,5587],{"class":174},"3668",[145,5589,195],{"class":158},[145,5591,5592],{"class":174},"4089",[145,5594,195],{"class":158},[145,5596,5597],{"class":174},"3060",[145,5599,195],{"class":158},[145,5601,5602],{"class":174},"2573",[145,5604,195],{"class":158},[145,5606,5607],{"class":174},"3456",[145,5609,195],{"class":158},[145,5611,5612],{"class":174},"2673",[145,5614,195],{"class":158},[145,5616,5617],{"class":174},"3876",[145,5619,195],{"class":158},[145,5621,5622],{"class":174},"4270",[145,5624,195],{"class":158},[145,5626,5627],{"class":174},"4716",[145,5629,195],{"class":158},[145,5631,5632],{"class":174},"2960",[145,5634,195],{"class":158},[145,5636,5637],{"class":174},"4180",[145,5639,195],{"class":158},[145,5641,5642],{"class":174},"4212",[145,5644,195],{"class":158},[145,5646,5647],{"class":174},"4400",[145,5649,195],{"class":158},[145,5651,5652],{"class":174},"4141",[145,5654,195],{"class":158},[145,5656,5657],{"class":174},"6216",[145,5659,195],{"class":158},[145,5661,5662],{"class":174},"3612",[145,5664,3359],{"class":158},[145,5666,5667,5669,5672,5674],{"class":147,"line":201},[145,5668,4792],{"class":174},[145,5670,5671],{"class":158},"(part2_c[:",[145,5673,5428],{"class":174},[145,5675,5676],{"class":158},"])\n",[145,5678,5679,5682,5684],{"class":147,"line":215},[145,5680,5681],{"class":158},"part2 ",[145,5683,1777],{"class":151},[145,5685,5686],{"class":2586}," \"\"\n",[145,5688,5689],{"class":147,"line":228},[145,5690,241],{"emptyLinePlaceholder":240},[145,5692,5693,5696,5699,5701],{"class":147,"line":237},[145,5694,5695],{"class":151},"from",[145,5697,5698],{"class":158}," string ",[145,5700,3233],{"class":151},[145,5702,5703],{"class":158}," printable\n",[145,5705,5706,5708,5710,5712,5714,5716,5718,5720,5722],{"class":147,"line":244},[145,5707,4769],{"class":151},[145,5709,3644],{"class":158},[145,5711,3536],{"class":151},[145,5713,3649],{"class":174},[145,5715,1817],{"class":158},[145,5717,1783],{"class":174},[145,5719,195],{"class":158},[145,5721,5428],{"class":174},[145,5723,3688],{"class":158},[145,5725,5726,5729,5732,5735,5737],{"class":147,"line":259},[145,5727,5728],{"class":174}," sum",[145,5730,5731],{"class":151}," =",[145,5733,5734],{"class":158}," part2_c[i] ",[145,5736,4056],{"class":151},[145,5738,5739],{"class":158}," i\n",[145,5741,5742,5744,5746,5748],{"class":147,"line":270},[145,5743,3530],{"class":151},[145,5745,3873],{"class":158},[145,5747,3536],{"class":151},[145,5749,5750],{"class":158}," printable:\n",[145,5752,5753,5755,5758,5760,5762,5764,5767,5769,5772],{"class":147,"line":284},[145,5754,1832],{"class":151},[145,5756,5757],{"class":174}," ord",[145,5759,4806],{"class":158},[145,5761,435],{"class":151},[145,5763,5757],{"class":174},[145,5765,5766],{"class":158},"(text[i]) ",[145,5768,1747],{"class":151},[145,5770,5771],{"class":174}," sum",[145,5773,3441],{"class":158},[145,5775,5776,5779,5781],{"class":147,"line":301},[145,5777,5778],{"class":158}," part2 ",[145,5780,2888],{"class":151},[145,5782,3946],{"class":158},[145,5784,5785],{"class":147,"line":312},[145,5786,3570],{"class":151},[145,5788,5789],{"class":147,"line":718},[145,5790,241],{"emptyLinePlaceholder":240},[145,5792,5793],{"class":147,"line":731},[145,5794,5795],{"class":1867},"# aHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3L1RZc0NLNEt4 => base64 => \"https...\"\n",[145,5797,5798,5800,5802,5805,5807],{"class":147,"line":747},[145,5799,5681],{"class":158},[145,5801,1777],{"class":151},[145,5803,5804],{"class":2586}," \"a\"",[145,5806,4007],{"class":151},[145,5808,5809],{"class":158}," part2 \n",[145,5811,5812,5814],{"class":147,"line":769},[145,5813,4792],{"class":174},[145,5815,5816],{"class":158},"(part2)\n",[2100,5818,5819],{},[16,5820,5821],{},[20,5822,5823],{},"aHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3L1RZc0NLNEt4",[16,5825,5826,5827],{},"Final flag is ",[20,5828,5829],{},"TRX{600dby3_d3@r_0p3n50urc3_aHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3L1RZc0NLNEt4}",[11,5831,5833],{"id":5832},"molly-revenge","Molly Revenge",[16,5835,5836],{},"Due to Molly dynamic dumping approach, Molly Revenge presents a hardened version of Molly, incorporating anti-debug checks, an new encryption\u002Fdecryption routine, fewer unlocked pages limit, and rigorous flag integrity verification.",[11,5838,5840],{"id":5839},"molly-revenge-decryptor","Molly Revenge Decryptor",[51,5842,5845],{"className":3224,"code":5843,"language":3226,"meta":5844,"style":59},"import sys\nimport pefile\nfrom Crypto.Cipher import ChaCha20\n\nchacha_key = bytes([\n 81, 90, 238, 246,\n 49, 96, 101, 57,\n 154, 226, 109, 170,\n 143, 34, 55, 109,\n 174, 11, 21, 112,\n 250, 101, 27, 136,\n 129, 218, 111, 100,\n 38, 121, 11, 3\n])\nchacha_nonce = bytes([0xd0, 0, 0, 0, 0, 0, 0, 0])\n\ndef main():\n if len(sys.argv) != 2:\n sys.exit(1)\n\n pe_path = sys.argv[1]\n\n try:\n pe = pefile.PE(pe_path)\n except Exception as e:\n sys.exit(1)\n\n text_section = None\n for section in pe.sections:\n if b'.text' in section.Name:\n text_section = section\n break\n\n if text_section is None:\n sys.exit(2)\n\n data = bytearray(text_section.get_data())\n pages = text_section.SizeOfRawData \u002F\u002F 0x1000\n \n \n for i in range(pages):\n offset = i * 0x1000\n cipher = ChaCha20.new(key=chacha_key, nonce=chacha_nonce) # fancy way to use ChaCha20 since nonce doesn't change\n data[offset:offset + 0x1000] = bytearray(cipher.decrypt(data[offset:offset + 0x1000]))\n \n\n pe.set_bytes_at_offset(text_section.PointerToRawData, bytes(data))\n pe.write('molly_revenge_dec.exe')\n \nif __name__ == \"__main__\":\n main()\n","Example of Molly Revenge decryptor",[20,5846,5847,5853,5859,5871,5875,5888,5911,5933,5955,5976,5998,6019,6041,6060,6064,6111,6115,6123,6137,6145,6149,6161,6165,6171,6179,6189,6197,6201,6209,6219,6231,6239,6243,6247,6259,6267,6271,6281,6295,6299,6303,6315,6329,6358,6387,6391,6395,6403,6412,6416,6428],{"__ignoreMap":59},[145,5848,5849,5851],{"class":147,"line":148},[145,5850,3233],{"class":151},[145,5852,3236],{"class":158},[145,5854,5855,5857],{"class":147,"line":168},[145,5856,3233],{"class":151},[145,5858,3243],{"class":158},[145,5860,5861,5863,5866,5868],{"class":147,"line":186},[145,5862,5695],{"class":151},[145,5864,5865],{"class":158}," Crypto.Cipher ",[145,5867,3233],{"class":151},[145,5869,5870],{"class":158}," ChaCha20\n",[145,5872,5873],{"class":147,"line":201},[145,5874,241],{"emptyLinePlaceholder":240},[145,5876,5877,5880,5882,5885],{"class":147,"line":215},[145,5878,5879],{"class":158},"chacha_key ",[145,5881,1777],{"class":151},[145,5883,5884],{"class":174}," bytes",[145,5886,5887],{"class":158},"([\n",[145,5889,5890,5893,5895,5898,5900,5903,5905,5908],{"class":147,"line":228},[145,5891,5892],{"class":174}," 81",[145,5894,195],{"class":158},[145,5896,5897],{"class":174},"90",[145,5899,195],{"class":158},[145,5901,5902],{"class":174},"238",[145,5904,195],{"class":158},[145,5906,5907],{"class":174},"246",[145,5909,5910],{"class":158},",\n",[145,5912,5913,5916,5918,5921,5923,5926,5928,5931],{"class":147,"line":237},[145,5914,5915],{"class":174}," 49",[145,5917,195],{"class":158},[145,5919,5920],{"class":174},"96",[145,5922,195],{"class":158},[145,5924,5925],{"class":174},"101",[145,5927,195],{"class":158},[145,5929,5930],{"class":174},"57",[145,5932,5910],{"class":158},[145,5934,5935,5938,5940,5943,5945,5948,5950,5953],{"class":147,"line":244},[145,5936,5937],{"class":174}," 154",[145,5939,195],{"class":158},[145,5941,5942],{"class":174},"226",[145,5944,195],{"class":158},[145,5946,5947],{"class":174},"109",[145,5949,195],{"class":158},[145,5951,5952],{"class":174},"170",[145,5954,5910],{"class":158},[145,5956,5957,5960,5962,5965,5967,5970,5972,5974],{"class":147,"line":259},[145,5958,5959],{"class":174}," 143",[145,5961,195],{"class":158},[145,5963,5964],{"class":174},"34",[145,5966,195],{"class":158},[145,5968,5969],{"class":174},"55",[145,5971,195],{"class":158},[145,5973,5947],{"class":174},[145,5975,5910],{"class":158},[145,5977,5978,5981,5983,5986,5988,5991,5993,5996],{"class":147,"line":270},[145,5979,5980],{"class":174}," 174",[145,5982,195],{"class":158},[145,5984,5985],{"class":174},"11",[145,5987,195],{"class":158},[145,5989,5990],{"class":174},"21",[145,5992,195],{"class":158},[145,5994,5995],{"class":174},"112",[145,5997,5910],{"class":158},[145,5999,6000,6003,6005,6007,6009,6012,6014,6017],{"class":147,"line":284},[145,6001,6002],{"class":174}," 250",[145,6004,195],{"class":158},[145,6006,5925],{"class":174},[145,6008,195],{"class":158},[145,6010,6011],{"class":174},"27",[145,6013,195],{"class":158},[145,6015,6016],{"class":174},"136",[145,6018,5910],{"class":158},[145,6020,6021,6024,6026,6029,6031,6034,6036,6039],{"class":147,"line":301},[145,6022,6023],{"class":174}," 129",[145,6025,195],{"class":158},[145,6027,6028],{"class":174},"218",[145,6030,195],{"class":158},[145,6032,6033],{"class":174},"111",[145,6035,195],{"class":158},[145,6037,6038],{"class":174},"100",[145,6040,5910],{"class":158},[145,6042,6043,6046,6048,6051,6053,6055,6057],{"class":147,"line":312},[145,6044,6045],{"class":174}," 38",[145,6047,195],{"class":158},[145,6049,6050],{"class":174},"121",[145,6052,195],{"class":158},[145,6054,5985],{"class":174},[145,6056,195],{"class":158},[145,6058,6059],{"class":174},"3\n",[145,6061,6062],{"class":147,"line":718},[145,6063,5676],{"class":158},[145,6065,6066,6069,6071,6073,6076,6078,6081,6083,6085,6087,6089,6091,6093,6095,6097,6099,6101,6103,6105,6107,6109],{"class":147,"line":731},[145,6067,6068],{"class":158},"chacha_nonce ",[145,6070,1777],{"class":151},[145,6072,5884],{"class":174},[145,6074,6075],{"class":158},"([",[145,6077,3165],{"class":151},[145,6079,6080],{"class":174},"d0",[145,6082,195],{"class":158},[145,6084,5447],{"class":174},[145,6086,195],{"class":158},[145,6088,5447],{"class":174},[145,6090,195],{"class":158},[145,6092,5447],{"class":174},[145,6094,195],{"class":158},[145,6096,5447],{"class":174},[145,6098,195],{"class":158},[145,6100,5447],{"class":174},[145,6102,195],{"class":158},[145,6104,5447],{"class":174},[145,6106,195],{"class":158},[145,6108,5447],{"class":174},[145,6110,5676],{"class":158},[145,6112,6113],{"class":147,"line":747},[145,6114,241],{"emptyLinePlaceholder":240},[145,6116,6117,6119,6121],{"class":147,"line":769},[145,6118,3364],{"class":151},[145,6120,3420],{"class":576},[145,6122,3423],{"class":158},[145,6124,6125,6127,6129,6131,6133,6135],{"class":147,"line":791},[145,6126,1808],{"class":151},[145,6128,3430],{"class":174},[145,6130,3433],{"class":158},[145,6132,2612],{"class":151},[145,6134,3438],{"class":174},[145,6136,3441],{"class":158},[145,6138,6139,6141,6143],{"class":147,"line":813},[145,6140,3446],{"class":158},[145,6142,1783],{"class":174},[145,6144,1895],{"class":158},[145,6146,6147],{"class":147,"line":834},[145,6148,241],{"emptyLinePlaceholder":240},[145,6150,6151,6153,6155,6157,6159],{"class":147,"line":855},[145,6152,3459],{"class":158},[145,6154,1777],{"class":151},[145,6156,3464],{"class":158},[145,6158,1783],{"class":174},[145,6160,3359],{"class":158},[145,6162,6163],{"class":147,"line":877},[145,6164,241],{"emptyLinePlaceholder":240},[145,6166,6167,6169],{"class":147,"line":899},[145,6168,3477],{"class":151},[145,6170,3441],{"class":158},[145,6172,6173,6175,6177],{"class":147,"line":921},[145,6174,3484],{"class":158},[145,6176,1777],{"class":151},[145,6178,3489],{"class":158},[145,6180,6181,6183,6185,6187],{"class":147,"line":943},[145,6182,3494],{"class":151},[145,6184,3497],{"class":174},[145,6186,3500],{"class":151},[145,6188,3503],{"class":158},[145,6190,6191,6193,6195],{"class":147,"line":965},[145,6192,3446],{"class":158},[145,6194,1783],{"class":174},[145,6196,1895],{"class":158},[145,6198,6199],{"class":147,"line":976},[145,6200,241],{"emptyLinePlaceholder":240},[145,6202,6203,6205,6207],{"class":147,"line":993},[145,6204,3520],{"class":158},[145,6206,1777],{"class":151},[145,6208,3525],{"class":174},[145,6210,6211,6213,6215,6217],{"class":147,"line":1012},[145,6212,3530],{"class":151},[145,6214,3533],{"class":158},[145,6216,3536],{"class":151},[145,6218,3539],{"class":158},[145,6220,6221,6223,6225,6227,6229],{"class":147,"line":1031},[145,6222,1832],{"class":151},[145,6224,3546],{"class":151},[145,6226,3549],{"class":2586},[145,6228,3552],{"class":151},[145,6230,3555],{"class":158},[145,6232,6233,6235,6237],{"class":147,"line":1050},[145,6234,3560],{"class":158},[145,6236,1777],{"class":151},[145,6238,3565],{"class":158},[145,6240,6241],{"class":147,"line":1069},[145,6242,3570],{"class":151},[145,6244,6245],{"class":147,"line":1088},[145,6246,241],{"emptyLinePlaceholder":240},[145,6248,6249,6251,6253,6255,6257],{"class":147,"line":1112},[145,6250,1808],{"class":151},[145,6252,3581],{"class":158},[145,6254,3584],{"class":151},[145,6256,3587],{"class":174},[145,6258,3441],{"class":158},[145,6260,6261,6263,6265],{"class":147,"line":1134},[145,6262,3446],{"class":158},[145,6264,3596],{"class":174},[145,6266,1895],{"class":158},[145,6268,6269],{"class":147,"line":1142},[145,6270,241],{"emptyLinePlaceholder":240},[145,6272,6273,6275,6277,6279],{"class":147,"line":1162},[145,6274,3607],{"class":158},[145,6276,1777],{"class":151},[145,6278,3612],{"class":174},[145,6280,3615],{"class":158},[145,6282,6283,6285,6287,6289,6291,6293],{"class":147,"line":1178},[145,6284,3620],{"class":158},[145,6286,1777],{"class":151},[145,6288,3625],{"class":158},[145,6290,3628],{"class":151},[145,6292,1792],{"class":151},[145,6294,3633],{"class":174},[145,6296,6297],{"class":147,"line":1197},[145,6298,1803],{"class":158},[145,6300,6301],{"class":147,"line":1216},[145,6302,1803],{"class":158},[145,6304,6305,6307,6309,6311,6313],{"class":147,"line":1235},[145,6306,3530],{"class":151},[145,6308,3644],{"class":158},[145,6310,3536],{"class":151},[145,6312,3649],{"class":174},[145,6314,3652],{"class":158},[145,6316,6317,6319,6321,6323,6325,6327],{"class":147,"line":1254},[145,6318,3657],{"class":158},[145,6320,1777],{"class":151},[145,6322,3644],{"class":158},[145,6324,2239],{"class":151},[145,6326,1792],{"class":151},[145,6328,3633],{"class":174},[145,6330,6331,6334,6336,6339,6342,6344,6347,6350,6352,6355],{"class":147,"line":1273},[145,6332,6333],{"class":158}," cipher ",[145,6335,1777],{"class":151},[145,6337,6338],{"class":158}," ChaCha20.new(",[145,6340,6341],{"class":2143},"key",[145,6343,1777],{"class":151},[145,6345,6346],{"class":158},"chacha_key, ",[145,6348,6349],{"class":2143},"nonce",[145,6351,1777],{"class":151},[145,6353,6354],{"class":158},"chacha_nonce) ",[145,6356,6357],{"class":1867},"# fancy way to use ChaCha20 since nonce doesn't change\n",[145,6359,6360,6363,6365,6367,6369,6371,6373,6375,6378,6380,6382,6384],{"class":147,"line":1285},[145,6361,6362],{"class":158}," data[offset:offset ",[145,6364,435],{"class":151},[145,6366,1792],{"class":151},[145,6368,2744],{"class":174},[145,6370,1786],{"class":158},[145,6372,1777],{"class":151},[145,6374,3612],{"class":174},[145,6376,6377],{"class":158},"(cipher.decrypt(data[offset:offset ",[145,6379,435],{"class":151},[145,6381,1792],{"class":151},[145,6383,2744],{"class":174},[145,6385,6386],{"class":158},"]))\n",[145,6388,6389],{"class":147,"line":1303},[145,6390,1803],{"class":158},[145,6392,6393],{"class":147,"line":1325},[145,6394,241],{"emptyLinePlaceholder":240},[145,6396,6397,6399,6401],{"class":147,"line":1348},[145,6398,3739],{"class":158},[145,6400,3742],{"class":174},[145,6402,3745],{"class":158},[145,6404,6405,6407,6410],{"class":147,"line":1371},[145,6406,3750],{"class":158},[145,6408,6409],{"class":2586},"'molly_revenge_dec.exe'",[145,6411,1895],{"class":158},[145,6413,6414],{"class":147,"line":1393},[145,6415,1803],{"class":158},[145,6417,6418,6420,6422,6424,6426],{"class":147,"line":1416},[145,6419,1735],{"class":151},[145,6421,3766],{"class":174},[145,6423,3769],{"class":151},[145,6425,3772],{"class":2586},[145,6427,3441],{"class":158},[145,6429,6430],{"class":147,"line":1439},[145,6431,3779],{"class":158},[6433,6434],"hr",{},[11,6436,6438],{"id":6437},"special-notes","Special Notes",[16,6440,6441,6442],{},"Molly reimplements the Byfron Hyperion anti-tamper feature, originally adopted in Roblox, in a simpler CTF-style manner. ",[6443,6444,6445],"em",{},"This explains the fancy descriptions.",[51,6447,6450],{"className":6448,"code":6449,"language":56},[54],"[Roblox] Developers,\n\nWe know how important anti-cheat and security are for you and the entire Roblox community. At RDC 1,7k, we announced that we’re turning our focus to cheat prevention. To help get us there, we’re thrilled to welcome Byfron, a leader in anti-cheat solutions, to Roblox. Together, we are combining forces to greatly expand Roblox’s anti-cheat capabilities.\n\nByfron has developed a state-of-the-art anti-cheat solution that is being utilized by some of the world’s largest game publishers. The team is also passionate about competitive gaming and security, so we think they’re going to be a great match for our community. With their deep domain knowledge and security engineering expertise, we will be accelerating our roadmap to build robust anti-cheat and security solutions. This includes client-side and server-side anti-cheat, alt accounts detection, and additional tools for developers to combat cheaters. Integrating Byfron’s technology into the Roblox platform will improve experience security, protect the competitive landscape, and to allow developers to spend more time building their experiences.\n\nWe look forward to sharing more in the coming months. In the meantime, please join us in welcoming Byfron to the Roblox community!\n",[20,6451,6449],{"__ignoreMap":59},[6453,6454,6455],"style",{},"html pre.shiki code .suJrU, html code.shiki .suJrU{--shiki-default:#FF7B72}html pre.shiki code .sZEs4, html code.shiki .sZEs4{--shiki-default:#E6EDF3}html pre.shiki code .sFSAA, html code.shiki .sFSAA{--shiki-default:#79C0FF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sc3cj, html code.shiki .sc3cj{--shiki-default:#D2A8FF}html pre.shiki code .sH3jZ, html code.shiki .sH3jZ{--shiki-default:#8B949E}html pre.shiki code .sQhOw, html code.shiki .sQhOw{--shiki-default:#FFA657}html pre.shiki code .s9uIt, html code.shiki .s9uIt{--shiki-default:#A5D6FF}",{"title":59,"searchDepth":168,"depth":168,"links":6457},[6458,6459,6460,6461,6462,6463,6464,6465,6466],{"id":13,"depth":168,"text":14},{"id":82,"depth":168,"text":83},{"id":114,"depth":168,"text":115},{"id":2116,"depth":168,"text":2117},{"id":3782,"depth":168,"text":3783},{"id":3824,"depth":168,"text":3825},{"id":5832,"depth":168,"text":5833},{"id":5839,"depth":168,"text":5840},{"id":6437,"depth":168,"text":6438},"2025-02-01","Deep dive into two of my CTF challenges focusing on reverse engineering and anti-tamper mechanisms","md",null,{"readingTime":731},"\u002Fb\u002Fmolly",{"title":6,"description":6468},{"loc":6472},"b\u002Fmolly",[6477,6478,6479,6480,6481],"reverse-engineering","ctf","winapi","anti-tamper","instrumentational-callback","X6L6V3bdC0iVGCorAMkDqZO3H1QlpVSsoPI4icJoEGE",1786184836295]