[{"data":1,"prerenderedAt":6482},["ShallowReactive",2],{"\u002Fb\u002Fmolly":3},{"id":4,"title":5,"body":6,"date":6466,"description":6467,"extension":6468,"image":6469,"meta":6470,"navigation":239,"path":6471,"seo":6472,"sitemap":6473,"stem":6474,"tags":6475,"__hash__":6481},"blog\u002Fb\u002Fmolly.md","Molly | TRX CTF 2025",{"type":7,"value":8,"toc":6455},"minimark",[9,14,26,36,43,49,59,70,79,83,105,111,115,118,136,316,325,331,376,390,542,554,565,1597,1604,1722,2071,2098,2113,2117,2122,3212,3215,3221,3779,3783,3789,3795,3798,3805,3812,3815,3821,3825,3843,4469,4673,4818,4825,5115,5122,5390,5397,5816,5823,5829,5833,5836,5840,6431,6434,6438,6445,6451],[10,11,13],"h2",{"id":12},"overview","Overview",[15,16,17,18,22,23],"p",{},"We are presented with two PE x86_64 binaries: ",[19,20,21],"code",{},"molly.exe"," and ",[19,24,25],{},"molly_dll.dll",[15,27,28,29,31,32,35],{},"Initially, disassembling ",[19,30,21],{}," reveals a multitude of unusual instructions. Furthermore, the high entropy in the ",[19,33,34],{},".text"," section suggests that the code is not standard executable code.",[15,37,38],{},[39,40],"img",{"alt":41,"src":42},"static_first_view","\u002Fresources\u002Fmolly\u002Fstatic_first_view.png",[15,44,45,46,48],{},"At this point we try running ",[19,47,21],{}," and see it produces the following output:\n(binary is safe, you can also check VirusTotal)",[50,51,56],"pre",{"className":52,"code":54,"language":55},[53],"language-text","@@@@@@@@@@@@@@@@@@@ , @@@@@@@@@@@@@@@@@@\n@@@@@@@@@@@\u002F \u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F \u002F@@@@@@@@@@\n@@@@@@@\u002F \u002F\u002F* \u002F\u002F. \u002F@@@@@@\n@@@@@ \u002F \u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F \u002F\u002F \u002F @@@@\n@@@\u002F \u002F \u002F\u002F \u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F \u002F \u002F@@\n@@ \u002F\u002F \u002F\u002F\u002F\u002F\u002F\u002F\u002F \u002F\u002F\u002F\u002F\u002F\u002F \u002F \u002F. @\n@\u002F \u002F \u002F\u002F\u002F\u002F\u002F\u002F \u002F\u002F\u002F\u002F\u002F*,. \u002F \u002F\n@ \u002F \u002F\u002F\u002F\u002F\u002F \u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F \u002F\n, \u002F \u002F\u002F\u002F\u002F\u002F \u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F \u002F\n@ \u002F \u002F\u002F\u002F\u002F\u002F ,\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F \u002F\n@\u002F \u002F \u002F\u002F\u002F\u002F \u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F \u002F \u002F\n@@ *\u002F \u002F\u002F \u002F\u002F\u002F\u002F \u002F\u002F\u002F\u002F\u002F \u002F, @\n@@@\u002F \u002F \u002F\u002F\u002F\u002F ,\u002F\u002F\u002F\u002F \u002F \u002F@@\n@@@@@ \u002F *\u002F\u002F \u002F .@@@@\n@@@@@@@\u002F \u002F\u002F \u002F\u002F. \u002F@@@@@@\n@@@@@@@@@@@\u002F \u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F\u002F \u002F@@@@@@@@@@\n\n> SYSTEM VALIDATION IN PROGRESS\n> USER MUST INPUT THE VERIFICATION TOKEN molly.exe \u003Ctoken>\n> SYSTEM STATE: STOPPING\n> USE WITH CAUTION, NO FAILURES ALLOWED\n","text",[19,57,54],{"__ignoreMap":58},"",[15,60,61,65,66,69],{},[62,63,64],"strong",{},"Note:","\nUpon executing Molly with an incorrect token, the binary becomes corrupted and an additional executable named ",[19,67,68],{},"why.exe"," is generated.",[15,71,72,73,75,76,78],{},"At this point ",[19,74,25],{}," likely plays a critical role in unpacking or decrypting ",[19,77,21],{},", making it the logical starting point for further analysis.",[10,80,82],{"id":81},"molly-dynamic-overview","Molly Dynamic Overview",[15,84,85,86,88,89,91,92,95,96,100,101,104],{},"By setting a breakpoint at the entry point of ",[19,87,21],{}," using x64dbg and examining the memory regions corresponding to the ",[19,90,34],{}," section, we observed that the section is fragmented. Some regions are marked as ",[19,93,94],{},"NO_ACCESS",", while others have a fixed size of ",[97,98,99],"b",{},"0x1000"," with ",[19,102,103],{},"READ_EXECUTE"," permissions. This suggests that molly.exe is not packed; rather, it is unpacked or decrypted and executed at runtime.",[15,106,107],{},[39,108],{"alt":109,"src":110},"x64dbg_regions","\u002Fresources\u002Fmolly\u002Fx64dbg_regions.png",[10,112,114],{"id":113},"dll-static-analysis","Dll Static Analysis",[15,116,117],{},"When the Windows loader calls an imported DLL with an entry point, it executes on the main thread before the process's own entry point. As a result, the process entry point will not run until all DLL entry points have completed.",[15,119,120,121,124,125,127,128,131,132,135],{},"Disassembling the ",[19,122,123],{},"dll_main"," function within ",[19,126,25],{}," reveals a call to ",[19,129,130],{},"GetProcAddress"," for resolving ",[19,133,134],{},"KiUserExceptionDispatcher",":",[50,137,141],{"className":138,"code":139,"language":140,"meta":58,"style":58},"language-asm shiki shiki-themes github-dark-default","call qword [rel GetCurrentProcess]\nlea rcx, [rel data_180006c48] {\"ntdll.dll\"}\nmov rbx, rax\ncall qword [rel GetModuleHandleA]\ntest rax, rax\nje 0x180002fb3\n\nlea rdx, [rel data_180006c58] {\"KiUserExceptionDispatcher\"}\nmov rcx, rax\ncall qword [rel GetProcAddress]\nmov qword [rel KiUserExceptionDispatcher_Add], rax\ntest rax, rax\nje 0x180002fb3\n","asm",[19,142,143,165,183,198,212,225,234,241,256,267,281,298,309],{"__ignoreMap":58},[144,145,148,152,155,159,162],"span",{"class":146,"line":147},"line",1,[144,149,151],{"class":150},"suJrU","call",[144,153,154],{"class":150}," qword",[144,156,158],{"class":157},"sZEs4"," [",[144,160,161],{"class":150},"rel",[144,163,164],{"class":157}," GetCurrentProcess]\n",[144,166,168,171,175,178,180],{"class":146,"line":167},2,[144,169,170],{"class":150},"lea",[144,172,174],{"class":173},"sFSAA"," rcx",[144,176,177],{"class":157},", [",[144,179,161],{"class":150},[144,181,182],{"class":157}," data_180006c48] {\"ntdll.dll\"}\n",[144,184,186,189,192,195],{"class":146,"line":185},3,[144,187,188],{"class":150},"mov",[144,190,191],{"class":173}," rbx",[144,193,194],{"class":157},", ",[144,196,197],{"class":173},"rax\n",[144,199,201,203,205,207,209],{"class":146,"line":200},4,[144,202,151],{"class":150},[144,204,154],{"class":150},[144,206,158],{"class":157},[144,208,161],{"class":150},[144,210,211],{"class":157}," GetModuleHandleA]\n",[144,213,215,218,221,223],{"class":146,"line":214},5,[144,216,217],{"class":150},"test",[144,219,220],{"class":173}," rax",[144,222,194],{"class":157},[144,224,197],{"class":173},[144,226,228,231],{"class":146,"line":227},6,[144,229,230],{"class":150},"je",[144,232,233],{"class":173}," 0x180002fb3\n",[144,235,237],{"class":146,"line":236},7,[144,238,240],{"emptyLinePlaceholder":239},true,"\n",[144,242,244,246,249,251,253],{"class":146,"line":243},8,[144,245,170],{"class":150},[144,247,248],{"class":173}," rdx",[144,250,177],{"class":157},[144,252,161],{"class":150},[144,254,255],{"class":157}," data_180006c58] {\"KiUserExceptionDispatcher\"}\n",[144,257,259,261,263,265],{"class":146,"line":258},9,[144,260,188],{"class":150},[144,262,174],{"class":173},[144,264,194],{"class":157},[144,266,197],{"class":173},[144,268,270,272,274,276,278],{"class":146,"line":269},10,[144,271,151],{"class":150},[144,273,154],{"class":150},[144,275,158],{"class":157},[144,277,161],{"class":150},[144,279,280],{"class":157}," GetProcAddress]\n",[144,282,284,286,289,291,293,296],{"class":146,"line":283},11,[144,285,188],{"class":150},[144,287,288],{"class":150}," qword",[144,290,158],{"class":157},[144,292,161],{"class":150},[144,294,295],{"class":157}," KiUserExceptionDispatcher_Add], ",[144,297,197],{"class":173},[144,299,301,303,305,307],{"class":146,"line":300},12,[144,302,217],{"class":150},[144,304,220],{"class":173},[144,306,194],{"class":157},[144,308,197],{"class":173},[144,310,312,314],{"class":146,"line":311},13,[144,313,230],{"class":150},[144,315,233],{"class":173},[15,317,318,319,321,322,324],{},"The resolution of ",[19,320,134],{}," implies that ",[19,323,25],{}," is involved in Windows exception handling, which could be key to its runtime decryption capabilities. Also no standard exception handler appears to be registered... Let's look deeper",[15,326,327,328,330],{},"An effective obfuscation technique observed in ",[19,329,25],{}," is the inline use of system calls, which \"obscures\" the actual API functions being utilized:",[50,332,334],{"className":138,"code":333,"language":140,"meta":58,"style":58},"mov eax, 0x1c\nmov r10, rcx\nsyscall \nretn {__return_addr}\n",[19,335,336,348,360,368],{"__ignoreMap":58},[144,337,338,340,343,345],{"class":146,"line":147},[144,339,188],{"class":150},[144,341,342],{"class":173}," eax",[144,344,194],{"class":157},[144,346,347],{"class":173},"0x1c\n",[144,349,350,352,355,357],{"class":146,"line":167},[144,351,188],{"class":150},[144,353,354],{"class":173}," r10",[144,356,194],{"class":157},[144,358,359],{"class":173},"rcx\n",[144,361,362,365],{"class":146,"line":185},[144,363,364],{"class":150},"syscall",[144,366,367],{"class":157}," \n",[144,369,370,373],{"class":146,"line":200},[144,371,372],{"class":150},"retn",[144,374,375],{"class":157}," {__return_addr}\n",[15,377,378,379,382,383,386,387],{},"After looking for ",[19,380,381],{},"eax, 0x1c"," syscall signature inside ",[19,384,385],{},"ntdll.dll"," we can confirm this function is a reimplementation of ",[19,388,389],{},"NtSetInformationProcess",[50,391,393],{"className":138,"code":392,"language":140,"meta":58,"style":58},"lea rax, [rel sub_1800030b0]\nmov r9d, 0x10\nmov qword [rsp+0x28 {var_10_1}], rax {sub_1800030b0}\nlea r8, [rsp+0x20 {infostruct}]\nxor eax, eax {0x0}\nmov edx, 0x28\nmov rcx, rbx\nmov qword [rsp+0x20 {infostruct}], rax {0x0}\ncall NtSetInformationProcess\n",[19,394,395,409,421,447,466,487,499,510,535],{"__ignoreMap":58},[144,396,397,399,402,404,406],{"class":146,"line":147},[144,398,170],{"class":150},[144,400,401],{"class":173}," rax",[144,403,177],{"class":157},[144,405,161],{"class":150},[144,407,408],{"class":157}," sub_1800030b0]\n",[144,410,411,413,416,418],{"class":146,"line":167},[144,412,188],{"class":150},[144,414,415],{"class":173}," r9d",[144,417,194],{"class":157},[144,419,420],{"class":173},"0x10\n",[144,422,423,425,427,429,432,435,438,441,444],{"class":146,"line":185},[144,424,188],{"class":150},[144,426,288],{"class":150},[144,428,158],{"class":157},[144,430,431],{"class":173},"rsp",[144,433,434],{"class":157},"+",[144,436,437],{"class":173},"0x28",[144,439,440],{"class":157}," {var_10_1}], ",[144,442,443],{"class":173},"rax",[144,445,446],{"class":157}," {sub_1800030b0}\n",[144,448,449,451,454,456,458,460,463],{"class":146,"line":200},[144,450,170],{"class":150},[144,452,453],{"class":173}," r8",[144,455,177],{"class":157},[144,457,431],{"class":173},[144,459,434],{"class":157},[144,461,462],{"class":173},"0x20",[144,464,465],{"class":157}," {infostruct}]\n",[144,467,468,471,473,475,478,481,484],{"class":146,"line":214},[144,469,470],{"class":150},"xor",[144,472,342],{"class":173},[144,474,194],{"class":157},[144,476,477],{"class":173},"eax",[144,479,480],{"class":157}," {",[144,482,483],{"class":173},"0x0",[144,485,486],{"class":157},"}\n",[144,488,489,491,494,496],{"class":146,"line":227},[144,490,188],{"class":150},[144,492,493],{"class":173}," edx",[144,495,194],{"class":157},[144,497,498],{"class":173},"0x28\n",[144,500,501,503,505,507],{"class":146,"line":236},[144,502,188],{"class":150},[144,504,174],{"class":173},[144,506,194],{"class":157},[144,508,509],{"class":173},"rbx\n",[144,511,512,514,516,518,520,522,524,527,529,531,533],{"class":146,"line":243},[144,513,188],{"class":150},[144,515,288],{"class":150},[144,517,158],{"class":157},[144,519,431],{"class":173},[144,521,434],{"class":157},[144,523,462],{"class":173},[144,525,526],{"class":157}," {infostruct}], ",[144,528,443],{"class":173},[144,530,480],{"class":157},[144,532,483],{"class":173},[144,534,486],{"class":157},[144,536,537,539],{"class":146,"line":258},[144,538,151],{"class":150},[144,540,541],{"class":157}," NtSetInformationProcess\n",[15,543,544,546,547,550,551,553],{},[19,545,389],{}," is invoked with the undocumented ",[19,548,549],{},"PROCESSINFOCLASS"," value ",[97,552,437],{},", which is responsible for setting an InstrumentationCallback in the process structure.",[15,555,556,557,560,561,564],{},"The function ",[19,558,559],{},"sub_1800030b0"," acts as this callback, being invoked during a kernel-mode to user-mode transition with a special register ",[19,562,563],{},"r15"," that points to the target user-mode function.",[50,566,569],{"className":138,"code":567,"language":140,"meta":568,"style":58},"ic_hook:\npush r10 {var_8_1}\npush rax {var_10}\npushfq {var_18}\npush rbx {__saved_rbx}\nmov rbx, rsp {__saved_rbx}\nlea rax, [rel ic_hook_handler]\ncmp rcx, rax\ncmove rcx, r10\nlea r10, [rsp-0xc0 {var_e0}]\nand r10 {var_e0}, 0xfffffffffffffff0\nmov rsp, r10\ncld \nsub rsp, 0x60\nmov qword [rsp {var_140}], rcx\nmov qword [rsp+0x8 {__saved_rdx}], rdx\nmov qword [rsp+0x10 {__saved_rdi}], rdi\nmov qword [rsp+0x18 {__saved_rsi}], rsi\nmov qword [rsp+0x20 {__saved_r8}], r8\nmov qword [rsp+0x28 {__saved_r9}], r9\nmov qword [rsp+0x30 {__saved_r11}], r11\nmov qword [rsp+0x38 {__saved_r12}], r12\nmov qword [rsp+0x40 {__saved_r13}], r13\nmov qword [rsp+0x48 {__saved_r14}], r14\nmov qword [rsp+0x50 {__saved_r15}], r15\nsub rsp, 0x60\nmovaps xmmword [rsp {__saved_zmm0}], xmm0\nmovaps xmmword [rsp+0x10 {__saved_zmm1}], xmm1\nmovaps xmmword [rsp+0x20 {__saved_zmm2}], xmm2\nmovaps xmmword [rsp+0x30 {__saved_zmm3}], xmm3\nmovaps xmmword [rsp+0x40 {__saved_zmm4}], xmm4\nmovaps xmmword [rsp+0x50 {__saved_zmm5}], xmm5\nmov rdx, qword [rbx+0x10 {var_10}]\nmov rcx, qword [rbx+0x18 {var_8_1}]\ncall ic_hook_handler\nmov qword [rbx+0x18 {var_8}], rax\nmovaps xmm0, xmmword [rsp {__saved_zmm0}]\nmovaps xmm1, xmmword [rsp+0x10 {__saved_zmm1}]\nmovaps xmm2, xmmword [rsp+0x20 {__saved_zmm2}]\nmovaps xmm3, xmmword [rsp+0x30 {__saved_zmm3}]\nmovaps xmm4, xmmword [rsp+0x40 {__saved_zmm4}]\nmovaps xmm5, xmmword [rsp+0x50 {__saved_zmm5}]\nadd rsp, 0x60\nmov rcx, qword [rsp {var_140}]\nmov rdx, qword [rsp+0x8 {__saved_rdx}]\nmov rdi, qword [rsp+0x10 {__saved_rdi}]\nmov rsi, qword [rsp+0x18 {__saved_rsi}]\nmov r8, qword [rsp+0x20 {__saved_r8}]\nmov r9, qword [rsp+0x28 {__saved_r9}]\nmov r11, qword [rsp+0x30 {__saved_r11}]\nmov r12, qword [rsp+0x38 {__saved_r12}]\nmov r13, qword [rsp+0x40 {__saved_r13}]\nmov r14, qword [rsp+0x48 {__saved_r14}]\nmov r15, qword [rsp+0x50 {__saved_r15}]\nadd rsp, 0x60\nmov rsp, rbx\npop rbx {__saved_rbx}\npopfq \npop rax {var_10}\npop r10 {var_8}\njmp r10\n","IC handler stub",[19,570,571,577,588,597,605,615,627,640,651,664,683,696,707,715,728,744,766,788,810,831,852,874,896,918,940,962,973,990,1009,1028,1047,1066,1085,1109,1131,1139,1159,1175,1194,1213,1232,1251,1270,1282,1300,1322,1345,1368,1390,1413,1436,1459,1482,1505,1528,1539,1550,1560,1569,1578,1588],{"__ignoreMap":58},[144,572,573],{"class":146,"line":147},[144,574,576],{"class":575},"sc3cj","ic_hook:\n",[144,578,579,582,585],{"class":146,"line":167},[144,580,581],{"class":150},"push",[144,583,584],{"class":173}," r10",[144,586,587],{"class":157}," {var_8_1}\n",[144,589,590,592,594],{"class":146,"line":185},[144,591,581],{"class":150},[144,593,220],{"class":173},[144,595,596],{"class":157}," {var_10}\n",[144,598,599,602],{"class":146,"line":200},[144,600,601],{"class":150},"pushfq",[144,603,604],{"class":157}," {var_18}\n",[144,606,607,609,612],{"class":146,"line":214},[144,608,581],{"class":150},[144,610,611],{"class":173}," rbx",[144,613,614],{"class":157}," {__saved_rbx}\n",[144,616,617,619,621,623,625],{"class":146,"line":227},[144,618,188],{"class":150},[144,620,191],{"class":173},[144,622,194],{"class":157},[144,624,431],{"class":173},[144,626,614],{"class":157},[144,628,629,631,633,635,637],{"class":146,"line":236},[144,630,170],{"class":150},[144,632,401],{"class":173},[144,634,177],{"class":157},[144,636,161],{"class":150},[144,638,639],{"class":157}," ic_hook_handler]\n",[144,641,642,645,647,649],{"class":146,"line":243},[144,643,644],{"class":150},"cmp",[144,646,174],{"class":173},[144,648,194],{"class":157},[144,650,197],{"class":173},[144,652,653,656,659,661],{"class":146,"line":258},[144,654,655],{"class":150},"cmove",[144,657,658],{"class":173}," rcx",[144,660,194],{"class":157},[144,662,663],{"class":173},"r10\n",[144,665,666,668,670,672,674,677,680],{"class":146,"line":269},[144,667,170],{"class":150},[144,669,354],{"class":173},[144,671,177],{"class":157},[144,673,431],{"class":173},[144,675,676],{"class":157},"-",[144,678,679],{"class":173},"0xc0",[144,681,682],{"class":157}," {var_e0}]\n",[144,684,685,688,690,693],{"class":146,"line":283},[144,686,687],{"class":150},"and",[144,689,354],{"class":173},[144,691,692],{"class":157}," {var_e0}, ",[144,694,695],{"class":173},"0xfffffffffffffff0\n",[144,697,698,700,703,705],{"class":146,"line":300},[144,699,188],{"class":150},[144,701,702],{"class":173}," rsp",[144,704,194],{"class":157},[144,706,663],{"class":173},[144,708,709,712],{"class":146,"line":311},[144,710,711],{"class":150},"cld",[144,713,714],{"class":157}," \n",[144,716,718,721,723,725],{"class":146,"line":717},14,[144,719,720],{"class":150},"sub",[144,722,702],{"class":173},[144,724,194],{"class":157},[144,726,727],{"class":173},"0x60\n",[144,729,731,733,735,737,739,742],{"class":146,"line":730},15,[144,732,188],{"class":150},[144,734,288],{"class":150},[144,736,158],{"class":157},[144,738,431],{"class":173},[144,740,741],{"class":157}," {var_140}], ",[144,743,359],{"class":173},[144,745,747,749,751,753,755,757,760,763],{"class":146,"line":746},16,[144,748,188],{"class":150},[144,750,288],{"class":150},[144,752,158],{"class":157},[144,754,431],{"class":173},[144,756,434],{"class":157},[144,758,759],{"class":173},"0x8",[144,761,762],{"class":157}," {__saved_rdx}], ",[144,764,765],{"class":173},"rdx\n",[144,767,769,771,773,775,777,779,782,785],{"class":146,"line":768},17,[144,770,188],{"class":150},[144,772,288],{"class":150},[144,774,158],{"class":157},[144,776,431],{"class":173},[144,778,434],{"class":157},[144,780,781],{"class":173},"0x10",[144,783,784],{"class":157}," {__saved_rdi}], ",[144,786,787],{"class":173},"rdi\n",[144,789,791,793,795,797,799,801,804,807],{"class":146,"line":790},18,[144,792,188],{"class":150},[144,794,288],{"class":150},[144,796,158],{"class":157},[144,798,431],{"class":173},[144,800,434],{"class":157},[144,802,803],{"class":173},"0x18",[144,805,806],{"class":157}," {__saved_rsi}], ",[144,808,809],{"class":173},"rsi\n",[144,811,813,815,817,819,821,823,825,828],{"class":146,"line":812},19,[144,814,188],{"class":150},[144,816,288],{"class":150},[144,818,158],{"class":157},[144,820,431],{"class":173},[144,822,434],{"class":157},[144,824,462],{"class":173},[144,826,827],{"class":157}," {__saved_r8}], ",[144,829,830],{"class":173},"r8\n",[144,832,834,836,838,840,842,844,846,849],{"class":146,"line":833},20,[144,835,188],{"class":150},[144,837,288],{"class":150},[144,839,158],{"class":157},[144,841,431],{"class":173},[144,843,434],{"class":157},[144,845,437],{"class":173},[144,847,848],{"class":157}," {__saved_r9}], ",[144,850,851],{"class":173},"r9\n",[144,853,855,857,859,861,863,865,868,871],{"class":146,"line":854},21,[144,856,188],{"class":150},[144,858,288],{"class":150},[144,860,158],{"class":157},[144,862,431],{"class":173},[144,864,434],{"class":157},[144,866,867],{"class":173},"0x30",[144,869,870],{"class":157}," {__saved_r11}], ",[144,872,873],{"class":173},"r11\n",[144,875,877,879,881,883,885,887,890,893],{"class":146,"line":876},22,[144,878,188],{"class":150},[144,880,288],{"class":150},[144,882,158],{"class":157},[144,884,431],{"class":173},[144,886,434],{"class":157},[144,888,889],{"class":173},"0x38",[144,891,892],{"class":157}," {__saved_r12}], ",[144,894,895],{"class":173},"r12\n",[144,897,899,901,903,905,907,909,912,915],{"class":146,"line":898},23,[144,900,188],{"class":150},[144,902,288],{"class":150},[144,904,158],{"class":157},[144,906,431],{"class":173},[144,908,434],{"class":157},[144,910,911],{"class":173},"0x40",[144,913,914],{"class":157}," {__saved_r13}], ",[144,916,917],{"class":173},"r13\n",[144,919,921,923,925,927,929,931,934,937],{"class":146,"line":920},24,[144,922,188],{"class":150},[144,924,288],{"class":150},[144,926,158],{"class":157},[144,928,431],{"class":173},[144,930,434],{"class":157},[144,932,933],{"class":173},"0x48",[144,935,936],{"class":157}," {__saved_r14}], ",[144,938,939],{"class":173},"r14\n",[144,941,943,945,947,949,951,953,956,959],{"class":146,"line":942},25,[144,944,188],{"class":150},[144,946,288],{"class":150},[144,948,158],{"class":157},[144,950,431],{"class":173},[144,952,434],{"class":157},[144,954,955],{"class":173},"0x50",[144,957,958],{"class":157}," {__saved_r15}], ",[144,960,961],{"class":173},"r15\n",[144,963,965,967,969,971],{"class":146,"line":964},26,[144,966,720],{"class":150},[144,968,702],{"class":173},[144,970,194],{"class":157},[144,972,727],{"class":173},[144,974,976,979,982,984,987],{"class":146,"line":975},27,[144,977,978],{"class":150},"movaps",[144,980,981],{"class":157}," xmmword [",[144,983,431],{"class":173},[144,985,986],{"class":157}," {__saved_zmm0}], ",[144,988,989],{"class":173},"xmm0\n",[144,991,993,995,997,999,1001,1003,1006],{"class":146,"line":992},28,[144,994,978],{"class":150},[144,996,981],{"class":157},[144,998,431],{"class":173},[144,1000,434],{"class":157},[144,1002,781],{"class":173},[144,1004,1005],{"class":157}," {__saved_zmm1}], ",[144,1007,1008],{"class":173},"xmm1\n",[144,1010,1012,1014,1016,1018,1020,1022,1025],{"class":146,"line":1011},29,[144,1013,978],{"class":150},[144,1015,981],{"class":157},[144,1017,431],{"class":173},[144,1019,434],{"class":157},[144,1021,462],{"class":173},[144,1023,1024],{"class":157}," {__saved_zmm2}], ",[144,1026,1027],{"class":173},"xmm2\n",[144,1029,1031,1033,1035,1037,1039,1041,1044],{"class":146,"line":1030},30,[144,1032,978],{"class":150},[144,1034,981],{"class":157},[144,1036,431],{"class":173},[144,1038,434],{"class":157},[144,1040,867],{"class":173},[144,1042,1043],{"class":157}," {__saved_zmm3}], ",[144,1045,1046],{"class":173},"xmm3\n",[144,1048,1050,1052,1054,1056,1058,1060,1063],{"class":146,"line":1049},31,[144,1051,978],{"class":150},[144,1053,981],{"class":157},[144,1055,431],{"class":173},[144,1057,434],{"class":157},[144,1059,911],{"class":173},[144,1061,1062],{"class":157}," {__saved_zmm4}], ",[144,1064,1065],{"class":173},"xmm4\n",[144,1067,1069,1071,1073,1075,1077,1079,1082],{"class":146,"line":1068},32,[144,1070,978],{"class":150},[144,1072,981],{"class":157},[144,1074,431],{"class":173},[144,1076,434],{"class":157},[144,1078,955],{"class":173},[144,1080,1081],{"class":157}," {__saved_zmm5}], ",[144,1083,1084],{"class":173},"xmm5\n",[144,1086,1088,1090,1092,1094,1097,1099,1102,1104,1106],{"class":146,"line":1087},33,[144,1089,188],{"class":150},[144,1091,248],{"class":173},[144,1093,194],{"class":157},[144,1095,1096],{"class":150},"qword",[144,1098,158],{"class":157},[144,1100,1101],{"class":173},"rbx",[144,1103,434],{"class":157},[144,1105,781],{"class":173},[144,1107,1108],{"class":157}," {var_10}]\n",[144,1110,1112,1114,1116,1118,1120,1122,1124,1126,1128],{"class":146,"line":1111},34,[144,1113,188],{"class":150},[144,1115,174],{"class":173},[144,1117,194],{"class":157},[144,1119,1096],{"class":150},[144,1121,158],{"class":157},[144,1123,1101],{"class":173},[144,1125,434],{"class":157},[144,1127,803],{"class":173},[144,1129,1130],{"class":157}," {var_8_1}]\n",[144,1132,1134,1136],{"class":146,"line":1133},35,[144,1135,151],{"class":150},[144,1137,1138],{"class":157}," ic_hook_handler\n",[144,1140,1142,1144,1146,1148,1150,1152,1154,1157],{"class":146,"line":1141},36,[144,1143,188],{"class":150},[144,1145,288],{"class":150},[144,1147,158],{"class":157},[144,1149,1101],{"class":173},[144,1151,434],{"class":157},[144,1153,803],{"class":173},[144,1155,1156],{"class":157}," {var_8}], ",[144,1158,197],{"class":173},[144,1160,1162,1164,1167,1170,1172],{"class":146,"line":1161},37,[144,1163,978],{"class":150},[144,1165,1166],{"class":173}," xmm0",[144,1168,1169],{"class":157},", xmmword [",[144,1171,431],{"class":173},[144,1173,1174],{"class":157}," {__saved_zmm0}]\n",[144,1176,1178,1180,1183,1185,1187,1189,1191],{"class":146,"line":1177},38,[144,1179,978],{"class":150},[144,1181,1182],{"class":173}," xmm1",[144,1184,1169],{"class":157},[144,1186,431],{"class":173},[144,1188,434],{"class":157},[144,1190,781],{"class":173},[144,1192,1193],{"class":157}," {__saved_zmm1}]\n",[144,1195,1197,1199,1202,1204,1206,1208,1210],{"class":146,"line":1196},39,[144,1198,978],{"class":150},[144,1200,1201],{"class":173}," xmm2",[144,1203,1169],{"class":157},[144,1205,431],{"class":173},[144,1207,434],{"class":157},[144,1209,462],{"class":173},[144,1211,1212],{"class":157}," {__saved_zmm2}]\n",[144,1214,1216,1218,1221,1223,1225,1227,1229],{"class":146,"line":1215},40,[144,1217,978],{"class":150},[144,1219,1220],{"class":173}," xmm3",[144,1222,1169],{"class":157},[144,1224,431],{"class":173},[144,1226,434],{"class":157},[144,1228,867],{"class":173},[144,1230,1231],{"class":157}," {__saved_zmm3}]\n",[144,1233,1235,1237,1240,1242,1244,1246,1248],{"class":146,"line":1234},41,[144,1236,978],{"class":150},[144,1238,1239],{"class":173}," xmm4",[144,1241,1169],{"class":157},[144,1243,431],{"class":173},[144,1245,434],{"class":157},[144,1247,911],{"class":173},[144,1249,1250],{"class":157}," {__saved_zmm4}]\n",[144,1252,1254,1256,1259,1261,1263,1265,1267],{"class":146,"line":1253},42,[144,1255,978],{"class":150},[144,1257,1258],{"class":173}," xmm5",[144,1260,1169],{"class":157},[144,1262,431],{"class":173},[144,1264,434],{"class":157},[144,1266,955],{"class":173},[144,1268,1269],{"class":157}," {__saved_zmm5}]\n",[144,1271,1273,1276,1278,1280],{"class":146,"line":1272},43,[144,1274,1275],{"class":150},"add",[144,1277,702],{"class":173},[144,1279,194],{"class":157},[144,1281,727],{"class":173},[144,1283,1285,1287,1289,1291,1293,1295,1297],{"class":146,"line":1284},44,[144,1286,188],{"class":150},[144,1288,174],{"class":173},[144,1290,194],{"class":157},[144,1292,1096],{"class":150},[144,1294,158],{"class":157},[144,1296,431],{"class":173},[144,1298,1299],{"class":157}," {var_140}]\n",[144,1301,1303,1305,1307,1309,1311,1313,1315,1317,1319],{"class":146,"line":1302},45,[144,1304,188],{"class":150},[144,1306,248],{"class":173},[144,1308,194],{"class":157},[144,1310,1096],{"class":150},[144,1312,158],{"class":157},[144,1314,431],{"class":173},[144,1316,434],{"class":157},[144,1318,759],{"class":173},[144,1320,1321],{"class":157}," {__saved_rdx}]\n",[144,1323,1325,1327,1330,1332,1334,1336,1338,1340,1342],{"class":146,"line":1324},46,[144,1326,188],{"class":150},[144,1328,1329],{"class":173}," rdi",[144,1331,194],{"class":157},[144,1333,1096],{"class":150},[144,1335,158],{"class":157},[144,1337,431],{"class":173},[144,1339,434],{"class":157},[144,1341,781],{"class":173},[144,1343,1344],{"class":157}," {__saved_rdi}]\n",[144,1346,1348,1350,1353,1355,1357,1359,1361,1363,1365],{"class":146,"line":1347},47,[144,1349,188],{"class":150},[144,1351,1352],{"class":173}," rsi",[144,1354,194],{"class":157},[144,1356,1096],{"class":150},[144,1358,158],{"class":157},[144,1360,431],{"class":173},[144,1362,434],{"class":157},[144,1364,803],{"class":173},[144,1366,1367],{"class":157}," {__saved_rsi}]\n",[144,1369,1371,1373,1375,1377,1379,1381,1383,1385,1387],{"class":146,"line":1370},48,[144,1372,188],{"class":150},[144,1374,453],{"class":173},[144,1376,194],{"class":157},[144,1378,1096],{"class":150},[144,1380,158],{"class":157},[144,1382,431],{"class":173},[144,1384,434],{"class":157},[144,1386,462],{"class":173},[144,1388,1389],{"class":157}," {__saved_r8}]\n",[144,1391,1393,1395,1398,1400,1402,1404,1406,1408,1410],{"class":146,"line":1392},49,[144,1394,188],{"class":150},[144,1396,1397],{"class":173}," r9",[144,1399,194],{"class":157},[144,1401,1096],{"class":150},[144,1403,158],{"class":157},[144,1405,431],{"class":173},[144,1407,434],{"class":157},[144,1409,437],{"class":173},[144,1411,1412],{"class":157}," {__saved_r9}]\n",[144,1414,1416,1418,1421,1423,1425,1427,1429,1431,1433],{"class":146,"line":1415},50,[144,1417,188],{"class":150},[144,1419,1420],{"class":173}," r11",[144,1422,194],{"class":157},[144,1424,1096],{"class":150},[144,1426,158],{"class":157},[144,1428,431],{"class":173},[144,1430,434],{"class":157},[144,1432,867],{"class":173},[144,1434,1435],{"class":157}," {__saved_r11}]\n",[144,1437,1439,1441,1444,1446,1448,1450,1452,1454,1456],{"class":146,"line":1438},51,[144,1440,188],{"class":150},[144,1442,1443],{"class":173}," r12",[144,1445,194],{"class":157},[144,1447,1096],{"class":150},[144,1449,158],{"class":157},[144,1451,431],{"class":173},[144,1453,434],{"class":157},[144,1455,889],{"class":173},[144,1457,1458],{"class":157}," {__saved_r12}]\n",[144,1460,1462,1464,1467,1469,1471,1473,1475,1477,1479],{"class":146,"line":1461},52,[144,1463,188],{"class":150},[144,1465,1466],{"class":173}," r13",[144,1468,194],{"class":157},[144,1470,1096],{"class":150},[144,1472,158],{"class":157},[144,1474,431],{"class":173},[144,1476,434],{"class":157},[144,1478,911],{"class":173},[144,1480,1481],{"class":157}," {__saved_r13}]\n",[144,1483,1485,1487,1490,1492,1494,1496,1498,1500,1502],{"class":146,"line":1484},53,[144,1486,188],{"class":150},[144,1488,1489],{"class":173}," r14",[144,1491,194],{"class":157},[144,1493,1096],{"class":150},[144,1495,158],{"class":157},[144,1497,431],{"class":173},[144,1499,434],{"class":157},[144,1501,933],{"class":173},[144,1503,1504],{"class":157}," {__saved_r14}]\n",[144,1506,1508,1510,1513,1515,1517,1519,1521,1523,1525],{"class":146,"line":1507},54,[144,1509,188],{"class":150},[144,1511,1512],{"class":173}," r15",[144,1514,194],{"class":157},[144,1516,1096],{"class":150},[144,1518,158],{"class":157},[144,1520,431],{"class":173},[144,1522,434],{"class":157},[144,1524,955],{"class":173},[144,1526,1527],{"class":157}," {__saved_r15}]\n",[144,1529,1531,1533,1535,1537],{"class":146,"line":1530},55,[144,1532,1275],{"class":150},[144,1534,702],{"class":173},[144,1536,194],{"class":157},[144,1538,727],{"class":173},[144,1540,1542,1544,1546,1548],{"class":146,"line":1541},56,[144,1543,188],{"class":150},[144,1545,702],{"class":173},[144,1547,194],{"class":157},[144,1549,509],{"class":173},[144,1551,1553,1556,1558],{"class":146,"line":1552},57,[144,1554,1555],{"class":150},"pop",[144,1557,191],{"class":173},[144,1559,614],{"class":157},[144,1561,1563,1566],{"class":146,"line":1562},58,[144,1564,1565],{"class":150},"popfq",[144,1567,1568],{"class":157}," \n",[144,1570,1572,1574,1576],{"class":146,"line":1571},59,[144,1573,1555],{"class":150},[144,1575,401],{"class":173},[144,1577,596],{"class":157},[144,1579,1581,1583,1585],{"class":146,"line":1580},60,[144,1582,1555],{"class":150},[144,1584,354],{"class":173},[144,1586,1587],{"class":157}," {var_8}\n",[144,1589,1591,1594],{"class":146,"line":1590},61,[144,1592,1593],{"class":150},"jmp",[144,1595,1596],{"class":173}," r10\n",[15,1598,1599,1600,1603],{},"The function in the middle is responsible for setting the return address. Basically, the argument it receives is the original return address and it compares it against one specific target function ",[19,1601,1602],{},"(KiUserExceptionDispatcher)",", if the addresses match up, then it returns a new hook otherwise it returns the argument passed.",[50,1605,1608],{"className":138,"code":1606,"language":140,"meta":1607,"style":58},"cld \nlea rcx, [rsp+0x4f0 {exp_record}]\nmov rdx, rsp {__return_addr}\ncall ki_user_exp_hook\ntest rax, rax\nje 0x1800031c0\n\njmp rax\n\ncld \nmov rcx, rsp {__return_addr}\nmov rdx, 0x0\ncall RtlRestoreContext {ic_hook_handler}\n","ki_user_exp_stub",[19,1609,1610,1616,1634,1647,1654,1664,1671,1675,1682,1686,1692,1704,1715],{"__ignoreMap":58},[144,1611,1612,1614],{"class":146,"line":147},[144,1613,711],{"class":150},[144,1615,714],{"class":157},[144,1617,1618,1620,1622,1624,1626,1628,1631],{"class":146,"line":167},[144,1619,170],{"class":150},[144,1621,174],{"class":173},[144,1623,177],{"class":157},[144,1625,431],{"class":173},[144,1627,434],{"class":157},[144,1629,1630],{"class":173},"0x4f0",[144,1632,1633],{"class":157}," {exp_record}]\n",[144,1635,1636,1638,1640,1642,1644],{"class":146,"line":185},[144,1637,188],{"class":150},[144,1639,248],{"class":173},[144,1641,194],{"class":157},[144,1643,431],{"class":173},[144,1645,1646],{"class":157}," {__return_addr}\n",[144,1648,1649,1651],{"class":146,"line":200},[144,1650,151],{"class":150},[144,1652,1653],{"class":157}," ki_user_exp_hook\n",[144,1655,1656,1658,1660,1662],{"class":146,"line":214},[144,1657,217],{"class":150},[144,1659,220],{"class":173},[144,1661,194],{"class":157},[144,1663,197],{"class":173},[144,1665,1666,1668],{"class":146,"line":227},[144,1667,230],{"class":150},[144,1669,1670],{"class":173}," 0x1800031c0\n",[144,1672,1673],{"class":146,"line":236},[144,1674,240],{"emptyLinePlaceholder":239},[144,1676,1677,1679],{"class":146,"line":243},[144,1678,1593],{"class":150},[144,1680,1681],{"class":173}," rax\n",[144,1683,1684],{"class":146,"line":258},[144,1685,240],{"emptyLinePlaceholder":239},[144,1687,1688,1690],{"class":146,"line":269},[144,1689,711],{"class":150},[144,1691,714],{"class":157},[144,1693,1694,1696,1698,1700,1702],{"class":146,"line":283},[144,1695,188],{"class":150},[144,1697,174],{"class":173},[144,1699,194],{"class":157},[144,1701,431],{"class":173},[144,1703,1646],{"class":157},[144,1705,1706,1708,1710,1712],{"class":146,"line":300},[144,1707,188],{"class":150},[144,1709,248],{"class":173},[144,1711,194],{"class":157},[144,1713,1714],{"class":173},"0x0\n",[144,1716,1717,1719],{"class":146,"line":311},[144,1718,151],{"class":150},[144,1720,1721],{"class":157}," RtlRestoreContext {ic_hook_handler}\n",[50,1723,1728],{"className":1724,"code":1725,"language":1726,"meta":1727,"style":58},"language-c shiki shiki-themes github-dark-default","if (exp_record->ExceptionCode == STATUS_ACCESS_VIOLATION && exp_record->ExceptionAddress)\n{\n uintptr_t page_base = exp_record->ExceptionInformation[1] & 0xfffffffffffff000;\n \n if (sub_180004110(&page_guard, page_base))\n {\n if (_Mtx_lock(&encryption_mutex))\n {\n std::_Throw_Cpp_error(5);\n \u002F* no return *\u002F\n }\n \n if (data_18000a05c == 0x7fffffff)\n {\n data_18000a05c = 0x7ffffffe;\n std::_Throw_Cpp_error(6);\n \u002F* no return *\u002F\n }\n \n sub_180003bd0(&page_guard, page_base);\n sub_180003de0(&page_guard);\n int64_t result = _Mtx_unlock(&encryption_mutex);\n exp_record->ExceptionCode = 0;\n exp_record->ExceptionFlags = 0;\n exp_record->ExceptionAddress = 0;\n exp_record->NumberParameters = 0;\n context->EFlags = 0xfe;\n return result; \u002F\u002F return 0\n }\n}\n\nreturn KiUserExceptionDispatcher_Add;\n","c","ki_user_exp_hook",[19,1729,1730,1761,1766,1798,1803,1822,1827,1844,1849,1862,1868,1873,1878,1895,1899,1913,1924,1928,1932,1936,1948,1960,1980,1992,2003,2014,2025,2039,2050,2055,2059,2063],{"__ignoreMap":58},[144,1731,1732,1735,1738,1741,1744,1747,1750,1753,1756,1758],{"class":146,"line":147},[144,1733,1734],{"class":150},"if",[144,1736,1737],{"class":157}," (exp_record",[144,1739,1740],{"class":150},"->",[144,1742,1743],{"class":157},"ExceptionCode ",[144,1745,1746],{"class":150},"==",[144,1748,1749],{"class":157}," STATUS_ACCESS_VIOLATION ",[144,1751,1752],{"class":150},"&&",[144,1754,1755],{"class":157}," exp_record",[144,1757,1740],{"class":150},[144,1759,1760],{"class":157},"ExceptionAddress)\n",[144,1762,1763],{"class":146,"line":167},[144,1764,1765],{"class":157},"{\n",[144,1767,1768,1771,1774,1777,1780,1783,1786,1789,1792,1795],{"class":146,"line":185},[144,1769,1770],{"class":150}," uintptr_t",[144,1772,1773],{"class":157}," page_base ",[144,1775,1776],{"class":150},"=",[144,1778,1779],{"class":157}," exp_record->ExceptionInformation[",[144,1781,1782],{"class":173},"1",[144,1784,1785],{"class":157},"] ",[144,1787,1788],{"class":150},"&",[144,1790,1791],{"class":150}," 0x",[144,1793,1794],{"class":173},"fffffffffffff000",[144,1796,1797],{"class":157},";\n",[144,1799,1800],{"class":146,"line":200},[144,1801,1802],{"class":157}," \n",[144,1804,1805,1808,1811,1814,1817,1819],{"class":146,"line":214},[144,1806,1807],{"class":150}," if",[144,1809,1810],{"class":157}," (",[144,1812,1813],{"class":575},"sub_180004110",[144,1815,1816],{"class":157},"(",[144,1818,1788],{"class":150},[144,1820,1821],{"class":157},"page_guard, page_base))\n",[144,1823,1824],{"class":146,"line":227},[144,1825,1826],{"class":157}," {\n",[144,1828,1829,1832,1834,1837,1839,1841],{"class":146,"line":236},[144,1830,1831],{"class":150}," if",[144,1833,1810],{"class":157},[144,1835,1836],{"class":575},"_Mtx_lock",[144,1838,1816],{"class":157},[144,1840,1788],{"class":150},[144,1842,1843],{"class":157},"encryption_mutex))\n",[144,1845,1846],{"class":146,"line":243},[144,1847,1848],{"class":157}," {\n",[144,1850,1851,1854,1856,1859],{"class":146,"line":258},[144,1852,1853],{"class":575}," std::_Throw_Cpp_error",[144,1855,1816],{"class":157},[144,1857,1858],{"class":173},"5",[144,1860,1861],{"class":157},");\n",[144,1863,1864],{"class":146,"line":269},[144,1865,1867],{"class":1866},"sH3jZ"," \u002F* no return *\u002F\n",[144,1869,1870],{"class":146,"line":283},[144,1871,1872],{"class":157}," }\n",[144,1874,1875],{"class":146,"line":300},[144,1876,1877],{"class":157}," \n",[144,1879,1880,1882,1885,1887,1889,1892],{"class":146,"line":311},[144,1881,1831],{"class":150},[144,1883,1884],{"class":157}," (data_18000a05c ",[144,1886,1746],{"class":150},[144,1888,1791],{"class":150},[144,1890,1891],{"class":173},"7fffffff",[144,1893,1894],{"class":157},")\n",[144,1896,1897],{"class":146,"line":717},[144,1898,1848],{"class":157},[144,1900,1901,1904,1906,1908,1911],{"class":146,"line":730},[144,1902,1903],{"class":157}," data_18000a05c ",[144,1905,1776],{"class":150},[144,1907,1791],{"class":150},[144,1909,1910],{"class":173},"7ffffffe",[144,1912,1797],{"class":157},[144,1914,1915,1917,1919,1922],{"class":146,"line":746},[144,1916,1853],{"class":575},[144,1918,1816],{"class":157},[144,1920,1921],{"class":173},"6",[144,1923,1861],{"class":157},[144,1925,1926],{"class":146,"line":768},[144,1927,1867],{"class":1866},[144,1929,1930],{"class":146,"line":790},[144,1931,1872],{"class":157},[144,1933,1934],{"class":146,"line":812},[144,1935,1877],{"class":157},[144,1937,1938,1941,1943,1945],{"class":146,"line":833},[144,1939,1940],{"class":575}," sub_180003bd0",[144,1942,1816],{"class":157},[144,1944,1788],{"class":150},[144,1946,1947],{"class":157},"page_guard, page_base);\n",[144,1949,1950,1953,1955,1957],{"class":146,"line":854},[144,1951,1952],{"class":575}," sub_180003de0",[144,1954,1816],{"class":157},[144,1956,1788],{"class":150},[144,1958,1959],{"class":157},"page_guard);\n",[144,1961,1962,1965,1968,1970,1973,1975,1977],{"class":146,"line":876},[144,1963,1964],{"class":150}," int64_t",[144,1966,1967],{"class":157}," result ",[144,1969,1776],{"class":150},[144,1971,1972],{"class":575}," _Mtx_unlock",[144,1974,1816],{"class":157},[144,1976,1788],{"class":150},[144,1978,1979],{"class":157},"encryption_mutex);\n",[144,1981,1982,1985,1987,1990],{"class":146,"line":898},[144,1983,1984],{"class":157}," exp_record->ExceptionCode ",[144,1986,1776],{"class":150},[144,1988,1989],{"class":173}," 0",[144,1991,1797],{"class":157},[144,1993,1994,1997,1999,2001],{"class":146,"line":920},[144,1995,1996],{"class":157}," exp_record->ExceptionFlags ",[144,1998,1776],{"class":150},[144,2000,1989],{"class":173},[144,2002,1797],{"class":157},[144,2004,2005,2008,2010,2012],{"class":146,"line":942},[144,2006,2007],{"class":157}," exp_record->ExceptionAddress ",[144,2009,1776],{"class":150},[144,2011,1989],{"class":173},[144,2013,1797],{"class":157},[144,2015,2016,2019,2021,2023],{"class":146,"line":964},[144,2017,2018],{"class":157}," exp_record->NumberParameters ",[144,2020,1776],{"class":150},[144,2022,1989],{"class":173},[144,2024,1797],{"class":157},[144,2026,2027,2030,2032,2034,2037],{"class":146,"line":975},[144,2028,2029],{"class":157}," context->EFlags ",[144,2031,1776],{"class":150},[144,2033,1791],{"class":150},[144,2035,2036],{"class":173},"fe",[144,2038,1797],{"class":157},[144,2040,2041,2044,2047],{"class":146,"line":992},[144,2042,2043],{"class":150}," return",[144,2045,2046],{"class":157}," result;",[144,2048,2049],{"class":1866}," \u002F\u002F return 0\n",[144,2051,2052],{"class":146,"line":1011},[144,2053,2054],{"class":157}," }\n",[144,2056,2057],{"class":146,"line":1030},[144,2058,486],{"class":157},[144,2060,2061],{"class":146,"line":1049},[144,2062,240],{"emptyLinePlaceholder":239},[144,2064,2065,2068],{"class":146,"line":1068},[144,2066,2067],{"class":150},"return",[144,2069,2070],{"class":157}," KiUserExceptionDispatcher_Add;\n",[15,2072,2073,2074,2076,2077,2080,2081,2083,2084,2087,2088,2090,2091,2093,2094,2097],{},"It is evident that ",[19,2075,1727],{}," handles ",[19,2078,2079],{},"STATUS_ACCESS_VIOLATION"," exceptions caused by attempts to access ",[19,2082,94],{}," pages, allowing ",[19,2085,2086],{},"sub_180003bd0"," to decrypt it. Once a guarded page is successfully decrypted, ",[19,2089,1607],{}," checks the return value from ",[19,2092,1727],{},". If the value is 0, it calls ",[19,2095,2096],{},"RtlRestoreContext"," to restore the execution state, allowing the binary to continue execution.",[2099,2100,2101],"blockquote",{},[15,2102,2103,2105,2106,2109,2112],{},[19,2104,1813],{}," check if the page is a guarded_page ",[2107,2108],"br",{},[19,2110,2111],{},"sub_180003de0"," is responsible to re-encrypts old pages, making runtime dumping \"ineffective\"",[10,2114,2116],{"id":2115},"binary-static-decryptor","Binary Static Decryptor",[15,2118,2119,2120,135],{},"Now let's look inside ",[19,2121,2086],{},[50,2123,2125],{"className":1724,"code":2124,"language":1726,"meta":58,"style":58},"void* decrypt_page(int32_t* arg1, uintptr_t page_base)\n\n{\n page_base_1 = page_base;\n void* result = sub_1800035f0(arg1, &page_base_1);\n \n if (result)\n {\n int64_t r8_16 = (((((((((((((((uint64_t)page_base ^ 0xcbf29ce484222325) * 0x100000001b3) ^ (uint64_t)(uint8_t)(page_base >> 8)) * 0x100000001b3) ^ (uint64_t)(uint8_t)(page_base >> 0x10)) * 0x100000001b3) ^ (uint64_t)(uint8_t)(page_base >> 0x18)) * 0x100000001b3) ^ (uint64_t)(uint8_t)(page_base >> 0x20)) * 0x100000001b3) ^ (uint64_t)(uint8_t)(page_base >> 0x28)) * 0x100000001b3) ^ (uint64_t)(uint8_t)(page_base >> 0x30)) * 0x100000001b3) ^ page_base >> 0x38;\n int64_t* rcx_9 = ((*(uint64_t*)((char*)arg1 + 0x30) & (r8_16 * 0x100000001b3)) \u003C\u003C 4) + *(uint64_t*)((char*)arg1 + 0x18);\n result = rcx_9[1];\n \n if (result == *(uint64_t*)((char*)arg1 + 8))\n {\n label_180003dcb:\n std::_Xout_of_range(\"invalid unordered_map\u003CK, T> key\");\n \u002F* no return *\u002F\n }\n \n while (page_base != *(uint64_t*)((char*)result + 0x10))\n {\n if (result == *(uint64_t*)rcx_9)\n goto label_180003dcb;\n \n result = *(uint64_t*)((char*)result + 8);\n }\n \n if (*(uint8_t*)((char*)result + 0x18))\n {\n flNewProtect = 0x1000;\n dwSize = page_base;\n void* var_38_1 = &arg_8;\n VirtualProtect(GetCurrentProcess(), &dwSize, &flNewProtect, 4);\n uintptr_t page_base_2 = page_base;\n int64_t r10_1 = 0;\n int64_t i_1 = 0x1000;\n int64_t i;\n \n do\n {\n uint8_t rax_15 = *(uint8_t*)page_base_2;\n page_base_2 += 1;\n int64_t rcx_12 = r10_1;\n uint8_t rotated_nibble = rax_15 >> 4 | rax_15 \u003C\u003C 4;\n int64_t rax_16;\n int64_t rdx_2;\n rdx_2 = HIGHQ(-0x7777777777777777 * r10_1);\n rax_16 = LOWQ(-0x7777777777777777 * r10_1);\n *(uint8_t*)(page_base_2 - 1) = rotated_nibble;\n r10_1 += 1;\n *(uint8_t*)(page_base_2 - 1) = rotated_nibble ^ page_guard_key[rcx_12 - (rdx_2 >> 3) * 0xf];\n i = i_1;\n i_1 -= 1;\n } while (i != 1);\n flNewProtect = 0x1000;\n dwSize = page_base;\n void* var_38_2 = &arg_8;\n VirtualProtect(GetCurrentProcess(), &dwSize, &flNewProtect, 0x20);\n return set_page_flag(arg1, page_base, false);\n }\n }\n \n return result;\n}\n",[19,2126,2127,2154,2158,2162,2172,2192,2196,2203,2207,2436,2517,2535,2539,2567,2571,2576,2589,2593,2597,2601,2633,2637,2655,2663,2668,2693,2697,2701,2728,2732,2746,2755,2771,2799,2811,2825,2840,2847,2851,2856,2861,2880,2893,2906,2932,2939,2946,2969,2989,3012,3023,3072,3082,3094,3111,3123,3131,3144,3169,3185,3189,3193,3198,3207],{"__ignoreMap":58},[144,2128,2129,2132,2135,2137,2140,2144,2146,2149,2152],{"class":146,"line":147},[144,2130,2131],{"class":150},"void*",[144,2133,2134],{"class":575}," decrypt_page",[144,2136,1816],{"class":157},[144,2138,2139],{"class":150},"int32_t*",[144,2141,2143],{"class":2142},"sQhOw"," arg1",[144,2145,194],{"class":157},[144,2147,2148],{"class":150},"uintptr_t",[144,2150,2151],{"class":2142}," page_base",[144,2153,1894],{"class":157},[144,2155,2156],{"class":146,"line":167},[144,2157,240],{"emptyLinePlaceholder":239},[144,2159,2160],{"class":146,"line":185},[144,2161,1765],{"class":157},[144,2163,2164,2167,2169],{"class":146,"line":200},[144,2165,2166],{"class":157}," page_base_1 ",[144,2168,1776],{"class":150},[144,2170,2171],{"class":157}," page_base;\n",[144,2173,2174,2177,2179,2181,2184,2187,2189],{"class":146,"line":214},[144,2175,2176],{"class":150}," void*",[144,2178,1967],{"class":157},[144,2180,1776],{"class":150},[144,2182,2183],{"class":575}," sub_1800035f0",[144,2185,2186],{"class":157},"(arg1, ",[144,2188,1788],{"class":150},[144,2190,2191],{"class":157},"page_base_1);\n",[144,2193,2194],{"class":146,"line":227},[144,2195,1802],{"class":157},[144,2197,2198,2200],{"class":146,"line":236},[144,2199,1807],{"class":150},[144,2201,2202],{"class":157}," (result)\n",[144,2204,2205],{"class":146,"line":243},[144,2206,1826],{"class":157},[144,2208,2209,2211,2214,2216,2219,2222,2225,2228,2230,2233,2236,2239,2241,2244,2246,2248,2250,2252,2255,2258,2261,2264,2267,2270,2272,2274,2276,2278,2280,2282,2284,2286,2288,2290,2292,2294,2297,2299,2301,2303,2305,2307,2309,2311,2313,2315,2317,2319,2321,2323,2326,2328,2330,2332,2334,2336,2338,2340,2342,2344,2346,2348,2350,2352,2355,2357,2359,2361,2363,2365,2367,2369,2371,2373,2375,2377,2379,2381,2384,2386,2388,2390,2392,2394,2396,2398,2400,2402,2404,2406,2408,2410,2413,2415,2417,2419,2421,2423,2425,2427,2429,2431,2434],{"class":146,"line":258},[144,2210,1964],{"class":150},[144,2212,2213],{"class":157}," r8_16 ",[144,2215,1776],{"class":150},[144,2217,2218],{"class":157}," (((((((((((((((",[144,2220,2221],{"class":150},"uint64_t",[144,2223,2224],{"class":157},")page_base ",[144,2226,2227],{"class":150},"^",[144,2229,1791],{"class":150},[144,2231,2232],{"class":173},"cbf29ce484222325",[144,2234,2235],{"class":157},") ",[144,2237,2238],{"class":150},"*",[144,2240,1791],{"class":150},[144,2242,2243],{"class":173},"100000001b3",[144,2245,2235],{"class":157},[144,2247,2227],{"class":150},[144,2249,1810],{"class":157},[144,2251,2221],{"class":150},[144,2253,2254],{"class":157},")(",[144,2256,2257],{"class":150},"uint8_t",[144,2259,2260],{"class":157},")(page_base ",[144,2262,2263],{"class":150},">>",[144,2265,2266],{"class":173}," 8",[144,2268,2269],{"class":157},")) ",[144,2271,2238],{"class":150},[144,2273,1791],{"class":150},[144,2275,2243],{"class":173},[144,2277,2235],{"class":157},[144,2279,2227],{"class":150},[144,2281,1810],{"class":157},[144,2283,2221],{"class":150},[144,2285,2254],{"class":157},[144,2287,2257],{"class":150},[144,2289,2260],{"class":157},[144,2291,2263],{"class":150},[144,2293,1791],{"class":150},[144,2295,2296],{"class":173},"10",[144,2298,2269],{"class":157},[144,2300,2238],{"class":150},[144,2302,1791],{"class":150},[144,2304,2243],{"class":173},[144,2306,2235],{"class":157},[144,2308,2227],{"class":150},[144,2310,1810],{"class":157},[144,2312,2221],{"class":150},[144,2314,2254],{"class":157},[144,2316,2257],{"class":150},[144,2318,2260],{"class":157},[144,2320,2263],{"class":150},[144,2322,1791],{"class":150},[144,2324,2325],{"class":173},"18",[144,2327,2269],{"class":157},[144,2329,2238],{"class":150},[144,2331,1791],{"class":150},[144,2333,2243],{"class":173},[144,2335,2235],{"class":157},[144,2337,2227],{"class":150},[144,2339,1810],{"class":157},[144,2341,2221],{"class":150},[144,2343,2254],{"class":157},[144,2345,2257],{"class":150},[144,2347,2260],{"class":157},[144,2349,2263],{"class":150},[144,2351,1791],{"class":150},[144,2353,2354],{"class":173},"20",[144,2356,2269],{"class":157},[144,2358,2238],{"class":150},[144,2360,1791],{"class":150},[144,2362,2243],{"class":173},[144,2364,2235],{"class":157},[144,2366,2227],{"class":150},[144,2368,1810],{"class":157},[144,2370,2221],{"class":150},[144,2372,2254],{"class":157},[144,2374,2257],{"class":150},[144,2376,2260],{"class":157},[144,2378,2263],{"class":150},[144,2380,1791],{"class":150},[144,2382,2383],{"class":173},"28",[144,2385,2269],{"class":157},[144,2387,2238],{"class":150},[144,2389,1791],{"class":150},[144,2391,2243],{"class":173},[144,2393,2235],{"class":157},[144,2395,2227],{"class":150},[144,2397,1810],{"class":157},[144,2399,2221],{"class":150},[144,2401,2254],{"class":157},[144,2403,2257],{"class":150},[144,2405,2260],{"class":157},[144,2407,2263],{"class":150},[144,2409,1791],{"class":150},[144,2411,2412],{"class":173},"30",[144,2414,2269],{"class":157},[144,2416,2238],{"class":150},[144,2418,1791],{"class":150},[144,2420,2243],{"class":173},[144,2422,2235],{"class":157},[144,2424,2227],{"class":150},[144,2426,1773],{"class":157},[144,2428,2263],{"class":150},[144,2430,1791],{"class":150},[144,2432,2433],{"class":173},"38",[144,2435,1797],{"class":157},[144,2437,2438,2441,2444,2446,2449,2451,2453,2456,2459,2462,2465,2467,2469,2471,2473,2475,2478,2480,2482,2484,2486,2489,2492,2494,2496,2499,2501,2503,2505,2507,2509,2511,2513,2515],{"class":146,"line":269},[144,2439,2440],{"class":150}," int64_t*",[144,2442,2443],{"class":157}," rcx_9 ",[144,2445,1776],{"class":150},[144,2447,2448],{"class":157}," ((",[144,2450,2238],{"class":150},[144,2452,1816],{"class":157},[144,2454,2455],{"class":150},"uint64_t*",[144,2457,2458],{"class":157},")((",[144,2460,2461],{"class":150},"char*",[144,2463,2464],{"class":157},")arg1 ",[144,2466,434],{"class":150},[144,2468,1791],{"class":150},[144,2470,2412],{"class":173},[144,2472,2235],{"class":157},[144,2474,1788],{"class":150},[144,2476,2477],{"class":157}," (r8_16 ",[144,2479,2238],{"class":150},[144,2481,1791],{"class":150},[144,2483,2243],{"class":173},[144,2485,2269],{"class":157},[144,2487,2488],{"class":150},"\u003C\u003C",[144,2490,2491],{"class":173}," 4",[144,2493,2235],{"class":157},[144,2495,434],{"class":150},[144,2497,2498],{"class":150}," *",[144,2500,1816],{"class":157},[144,2502,2455],{"class":150},[144,2504,2458],{"class":157},[144,2506,2461],{"class":150},[144,2508,2464],{"class":157},[144,2510,434],{"class":150},[144,2512,1791],{"class":150},[144,2514,2325],{"class":173},[144,2516,1861],{"class":157},[144,2518,2519,2522,2524,2527,2530,2532],{"class":146,"line":283},[144,2520,2521],{"class":157}," result ",[144,2523,1776],{"class":150},[144,2525,2526],{"class":2142}," rcx_9",[144,2528,2529],{"class":157},"[",[144,2531,1782],{"class":173},[144,2533,2534],{"class":157},"];\n",[144,2536,2537],{"class":146,"line":300},[144,2538,1877],{"class":157},[144,2540,2541,2543,2546,2548,2550,2552,2554,2556,2558,2560,2562,2564],{"class":146,"line":311},[144,2542,1831],{"class":150},[144,2544,2545],{"class":157}," (result ",[144,2547,1746],{"class":150},[144,2549,2498],{"class":150},[144,2551,1816],{"class":157},[144,2553,2455],{"class":150},[144,2555,2458],{"class":157},[144,2557,2461],{"class":150},[144,2559,2464],{"class":157},[144,2561,434],{"class":150},[144,2563,2266],{"class":173},[144,2565,2566],{"class":157},"))\n",[144,2568,2569],{"class":146,"line":717},[144,2570,1848],{"class":157},[144,2572,2573],{"class":146,"line":730},[144,2574,2575],{"class":157}," label_180003dcb:\n",[144,2577,2578,2581,2583,2587],{"class":146,"line":746},[144,2579,2580],{"class":575}," std::_Xout_of_range",[144,2582,1816],{"class":157},[144,2584,2586],{"class":2585},"s9uIt","\"invalid unordered_map\u003CK, T> key\"",[144,2588,1861],{"class":157},[144,2590,2591],{"class":146,"line":768},[144,2592,1867],{"class":1866},[144,2594,2595],{"class":146,"line":790},[144,2596,1872],{"class":157},[144,2598,2599],{"class":146,"line":812},[144,2600,1877],{"class":157},[144,2602,2603,2606,2609,2612,2614,2616,2618,2620,2622,2625,2627,2629,2631],{"class":146,"line":833},[144,2604,2605],{"class":150}," while",[144,2607,2608],{"class":157}," (page_base ",[144,2610,2611],{"class":150},"!=",[144,2613,2498],{"class":150},[144,2615,1816],{"class":157},[144,2617,2455],{"class":150},[144,2619,2458],{"class":157},[144,2621,2461],{"class":150},[144,2623,2624],{"class":157},")result ",[144,2626,434],{"class":150},[144,2628,1791],{"class":150},[144,2630,2296],{"class":173},[144,2632,2566],{"class":157},[144,2634,2635],{"class":146,"line":854},[144,2636,1848],{"class":157},[144,2638,2639,2642,2644,2646,2648,2650,2652],{"class":146,"line":876},[144,2640,2641],{"class":150}," if",[144,2643,2545],{"class":157},[144,2645,1746],{"class":150},[144,2647,2498],{"class":150},[144,2649,1816],{"class":157},[144,2651,2455],{"class":150},[144,2653,2654],{"class":157},")rcx_9)\n",[144,2656,2657,2660],{"class":146,"line":898},[144,2658,2659],{"class":150}," goto",[144,2661,2662],{"class":157}," label_180003dcb;\n",[144,2664,2665],{"class":146,"line":920},[144,2666,2667],{"class":157}," \n",[144,2669,2670,2673,2675,2677,2679,2681,2683,2685,2687,2689,2691],{"class":146,"line":942},[144,2671,2672],{"class":157}," result ",[144,2674,1776],{"class":150},[144,2676,2498],{"class":150},[144,2678,1816],{"class":157},[144,2680,2455],{"class":150},[144,2682,2458],{"class":157},[144,2684,2461],{"class":150},[144,2686,2624],{"class":157},[144,2688,434],{"class":150},[144,2690,2266],{"class":173},[144,2692,1861],{"class":157},[144,2694,2695],{"class":146,"line":964},[144,2696,1872],{"class":157},[144,2698,2699],{"class":146,"line":975},[144,2700,1877],{"class":157},[144,2702,2703,2705,2707,2709,2711,2714,2716,2718,2720,2722,2724,2726],{"class":146,"line":992},[144,2704,1831],{"class":150},[144,2706,1810],{"class":157},[144,2708,2238],{"class":150},[144,2710,1816],{"class":157},[144,2712,2713],{"class":150},"uint8_t*",[144,2715,2458],{"class":157},[144,2717,2461],{"class":150},[144,2719,2624],{"class":157},[144,2721,434],{"class":150},[144,2723,1791],{"class":150},[144,2725,2325],{"class":173},[144,2727,2566],{"class":157},[144,2729,2730],{"class":146,"line":1011},[144,2731,1848],{"class":157},[144,2733,2734,2737,2739,2741,2744],{"class":146,"line":1030},[144,2735,2736],{"class":157}," flNewProtect ",[144,2738,1776],{"class":150},[144,2740,1791],{"class":150},[144,2742,2743],{"class":173},"1000",[144,2745,1797],{"class":157},[144,2747,2748,2751,2753],{"class":146,"line":1049},[144,2749,2750],{"class":157}," dwSize ",[144,2752,1776],{"class":150},[144,2754,2171],{"class":157},[144,2756,2757,2760,2763,2765,2768],{"class":146,"line":1068},[144,2758,2759],{"class":150}," void*",[144,2761,2762],{"class":157}," var_38_1 ",[144,2764,1776],{"class":150},[144,2766,2767],{"class":150}," &",[144,2769,2770],{"class":157},"arg_8;\n",[144,2772,2773,2776,2778,2781,2784,2786,2789,2791,2794,2797],{"class":146,"line":1087},[144,2774,2775],{"class":575}," VirtualProtect",[144,2777,1816],{"class":157},[144,2779,2780],{"class":575},"GetCurrentProcess",[144,2782,2783],{"class":157},"(), ",[144,2785,1788],{"class":150},[144,2787,2788],{"class":157},"dwSize, ",[144,2790,1788],{"class":150},[144,2792,2793],{"class":157},"flNewProtect, ",[144,2795,2796],{"class":173},"4",[144,2798,1861],{"class":157},[144,2800,2801,2804,2807,2809],{"class":146,"line":1111},[144,2802,2803],{"class":150}," uintptr_t",[144,2805,2806],{"class":157}," page_base_2 ",[144,2808,1776],{"class":150},[144,2810,2171],{"class":157},[144,2812,2813,2816,2819,2821,2823],{"class":146,"line":1133},[144,2814,2815],{"class":150}," int64_t",[144,2817,2818],{"class":157}," r10_1 ",[144,2820,1776],{"class":150},[144,2822,1989],{"class":173},[144,2824,1797],{"class":157},[144,2826,2827,2829,2832,2834,2836,2838],{"class":146,"line":1141},[144,2828,2815],{"class":150},[144,2830,2831],{"class":157}," i_1 ",[144,2833,1776],{"class":150},[144,2835,1791],{"class":150},[144,2837,2743],{"class":173},[144,2839,1797],{"class":157},[144,2841,2842,2844],{"class":146,"line":1161},[144,2843,2815],{"class":150},[144,2845,2846],{"class":157}," i;\n",[144,2848,2849],{"class":146,"line":1177},[144,2850,2667],{"class":157},[144,2852,2853],{"class":146,"line":1196},[144,2854,2855],{"class":150}," do\n",[144,2857,2858],{"class":146,"line":1215},[144,2859,2860],{"class":157}," {\n",[144,2862,2863,2866,2869,2871,2873,2875,2877],{"class":146,"line":1234},[144,2864,2865],{"class":150}," uint8_t",[144,2867,2868],{"class":157}," rax_15 ",[144,2870,1776],{"class":150},[144,2872,2498],{"class":150},[144,2874,1816],{"class":157},[144,2876,2713],{"class":150},[144,2878,2879],{"class":157},")page_base_2;\n",[144,2881,2882,2885,2888,2891],{"class":146,"line":1253},[144,2883,2884],{"class":157}," page_base_2 ",[144,2886,2887],{"class":150},"+=",[144,2889,2890],{"class":173}," 1",[144,2892,1797],{"class":157},[144,2894,2895,2898,2901,2903],{"class":146,"line":1272},[144,2896,2897],{"class":150}," int64_t",[144,2899,2900],{"class":157}," rcx_12 ",[144,2902,1776],{"class":150},[144,2904,2905],{"class":157}," r10_1;\n",[144,2907,2908,2910,2913,2915,2917,2919,2921,2924,2926,2928,2930],{"class":146,"line":1284},[144,2909,2865],{"class":150},[144,2911,2912],{"class":157}," rotated_nibble ",[144,2914,1776],{"class":150},[144,2916,2868],{"class":157},[144,2918,2263],{"class":150},[144,2920,2491],{"class":173},[144,2922,2923],{"class":150}," |",[144,2925,2868],{"class":157},[144,2927,2488],{"class":150},[144,2929,2491],{"class":173},[144,2931,1797],{"class":157},[144,2933,2934,2936],{"class":146,"line":1302},[144,2935,2897],{"class":150},[144,2937,2938],{"class":157}," rax_16;\n",[144,2940,2941,2943],{"class":146,"line":1324},[144,2942,2897],{"class":150},[144,2944,2945],{"class":157}," rdx_2;\n",[144,2947,2948,2951,2953,2956,2958,2961,2964,2966],{"class":146,"line":1347},[144,2949,2950],{"class":157}," rdx_2 ",[144,2952,1776],{"class":150},[144,2954,2955],{"class":575}," HIGHQ",[144,2957,1816],{"class":157},[144,2959,2960],{"class":150},"-0x",[144,2962,2963],{"class":173},"7777777777777777",[144,2965,2498],{"class":150},[144,2967,2968],{"class":157}," r10_1);\n",[144,2970,2971,2974,2976,2979,2981,2983,2985,2987],{"class":146,"line":1370},[144,2972,2973],{"class":157}," rax_16 ",[144,2975,1776],{"class":150},[144,2977,2978],{"class":575}," LOWQ",[144,2980,1816],{"class":157},[144,2982,2960],{"class":150},[144,2984,2963],{"class":173},[144,2986,2498],{"class":150},[144,2988,2968],{"class":157},[144,2990,2991,2994,2996,2998,3001,3003,3005,3007,3009],{"class":146,"line":1392},[144,2992,2993],{"class":150}," *",[144,2995,1816],{"class":157},[144,2997,2713],{"class":150},[144,2999,3000],{"class":157},")(page_base_2 ",[144,3002,676],{"class":150},[144,3004,2890],{"class":173},[144,3006,2235],{"class":157},[144,3008,1776],{"class":150},[144,3010,3011],{"class":157}," rotated_nibble;\n",[144,3013,3014,3017,3019,3021],{"class":146,"line":1415},[144,3015,3016],{"class":157}," r10_1 ",[144,3018,2887],{"class":150},[144,3020,2890],{"class":173},[144,3022,1797],{"class":157},[144,3024,3025,3027,3029,3031,3033,3035,3037,3039,3041,3043,3045,3048,3051,3053,3056,3058,3061,3063,3065,3067,3070],{"class":146,"line":1438},[144,3026,2993],{"class":150},[144,3028,1816],{"class":157},[144,3030,2713],{"class":150},[144,3032,3000],{"class":157},[144,3034,676],{"class":150},[144,3036,2890],{"class":173},[144,3038,2235],{"class":157},[144,3040,1776],{"class":150},[144,3042,2912],{"class":157},[144,3044,2227],{"class":150},[144,3046,3047],{"class":2142}," page_guard_key",[144,3049,3050],{"class":157},"[rcx_12 ",[144,3052,676],{"class":150},[144,3054,3055],{"class":157}," (rdx_2 ",[144,3057,2263],{"class":150},[144,3059,3060],{"class":173}," 3",[144,3062,2235],{"class":157},[144,3064,2238],{"class":150},[144,3066,1791],{"class":150},[144,3068,3069],{"class":173},"f",[144,3071,2534],{"class":157},[144,3073,3074,3077,3079],{"class":146,"line":1461},[144,3075,3076],{"class":157}," i ",[144,3078,1776],{"class":150},[144,3080,3081],{"class":157}," i_1;\n",[144,3083,3084,3087,3090,3092],{"class":146,"line":1484},[144,3085,3086],{"class":157}," i_1 ",[144,3088,3089],{"class":150},"-=",[144,3091,2890],{"class":173},[144,3093,1797],{"class":157},[144,3095,3096,3099,3102,3105,3107,3109],{"class":146,"line":1507},[144,3097,3098],{"class":157}," } ",[144,3100,3101],{"class":150},"while",[144,3103,3104],{"class":157}," (i ",[144,3106,2611],{"class":150},[144,3108,2890],{"class":173},[144,3110,1861],{"class":157},[144,3112,3113,3115,3117,3119,3121],{"class":146,"line":1530},[144,3114,2736],{"class":157},[144,3116,1776],{"class":150},[144,3118,1791],{"class":150},[144,3120,2743],{"class":173},[144,3122,1797],{"class":157},[144,3124,3125,3127,3129],{"class":146,"line":1541},[144,3126,2750],{"class":157},[144,3128,1776],{"class":150},[144,3130,2171],{"class":157},[144,3132,3133,3135,3138,3140,3142],{"class":146,"line":1552},[144,3134,2759],{"class":150},[144,3136,3137],{"class":157}," var_38_2 ",[144,3139,1776],{"class":150},[144,3141,2767],{"class":150},[144,3143,2770],{"class":157},[144,3145,3146,3148,3150,3152,3154,3156,3158,3160,3162,3165,3167],{"class":146,"line":1562},[144,3147,2775],{"class":575},[144,3149,1816],{"class":157},[144,3151,2780],{"class":575},[144,3153,2783],{"class":157},[144,3155,1788],{"class":150},[144,3157,2788],{"class":157},[144,3159,1788],{"class":150},[144,3161,2793],{"class":157},[144,3163,3164],{"class":150},"0x",[144,3166,2354],{"class":173},[144,3168,1861],{"class":157},[144,3170,3171,3174,3177,3180,3183],{"class":146,"line":1571},[144,3172,3173],{"class":150}," return",[144,3175,3176],{"class":575}," set_page_flag",[144,3178,3179],{"class":157},"(arg1, page_base, ",[144,3181,3182],{"class":173},"false",[144,3184,1861],{"class":157},[144,3186,3187],{"class":146,"line":1580},[144,3188,1872],{"class":157},[144,3190,3191],{"class":146,"line":1590},[144,3192,2054],{"class":157},[144,3194,3196],{"class":146,"line":3195},62,[144,3197,1802],{"class":157},[144,3199,3201,3204],{"class":146,"line":3200},63,[144,3202,3203],{"class":150}," return",[144,3205,3206],{"class":157}," result;\n",[144,3208,3210],{"class":146,"line":3209},64,[144,3211,486],{"class":157},[15,3213,3214],{},"MollyDll decryption routine is quite simple, it first xor using a known key and then rotate the byte nibbles.",[15,3216,3217,3218,3220],{},"We can write a simple python script that decrypt ",[19,3219,21],{}," .text section:",[50,3222,3226],{"className":3223,"code":3224,"language":3225,"meta":58,"style":58},"language-py shiki shiki-themes github-dark-default","import sys\nimport pefile\n\nkey = [0x66,0x6f,0x72,0x67,0x69,0x76,0x65,0x6d,0x65,0x66,0x61,0x74,0x68,0x65,0x72]\ndef invert_nibbles(b):\n return (b & 0xf0) >> 4 | (b & 0x0f) \u003C\u003C 4 \n\ndef main():\n if len(sys.argv) != 2:\n sys.exit(1)\n\n pe_path = sys.argv[1]\n\n try:\n pe = pefile.PE(pe_path)\n except Exception as e:\n sys.exit(1)\n\n text_section = None\n for section in pe.sections:\n if b'.text' in section.Name:\n text_section = section\n break\n\n if text_section is None:\n sys.exit(2)\n\n data = bytearray(text_section.get_data())\n pages = text_section.SizeOfRawData \u002F\u002F 0x1000\n \n for i in range(pages):\n offset = i * 0x1000\n for j in range(0x1000):\n data[offset + j] = invert_nibbles(data[offset + j])\n data[offset + j] ^= key[j % len(key)]\n\n pe.set_bytes_at_offset(text_section.PointerToRawData, bytes(data))\n pe.write('molly_dec.exe')\n \nif __name__ == \"__main__\":\n main()\n","py",[19,3227,3228,3236,3243,3247,3359,3370,3409,3413,3423,3441,3450,3454,3468,3472,3479,3489,3503,3511,3515,3525,3539,3555,3565,3570,3574,3589,3598,3602,3615,3633,3637,3652,3667,3688,3708,3730,3734,3745,3755,3759,3774],{"__ignoreMap":58},[144,3229,3230,3233],{"class":146,"line":147},[144,3231,3232],{"class":150},"import",[144,3234,3235],{"class":157}," sys\n",[144,3237,3238,3240],{"class":146,"line":167},[144,3239,3232],{"class":150},[144,3241,3242],{"class":157}," pefile\n",[144,3244,3245],{"class":146,"line":185},[144,3246,240],{"emptyLinePlaceholder":239},[144,3248,3249,3252,3254,3256,3258,3261,3264,3266,3269,3271,3273,3276,3278,3280,3283,3285,3287,3290,3292,3294,3297,3299,3301,3304,3306,3308,3311,3313,3315,3317,3319,3321,3323,3325,3327,3330,3332,3334,3337,3339,3341,3344,3346,3348,3350,3352,3354,3356],{"class":146,"line":200},[144,3250,3251],{"class":157},"key ",[144,3253,1776],{"class":150},[144,3255,158],{"class":157},[144,3257,3164],{"class":150},[144,3259,3260],{"class":173},"66",[144,3262,3263],{"class":157},",",[144,3265,3164],{"class":150},[144,3267,3268],{"class":173},"6f",[144,3270,3263],{"class":157},[144,3272,3164],{"class":150},[144,3274,3275],{"class":173},"72",[144,3277,3263],{"class":157},[144,3279,3164],{"class":150},[144,3281,3282],{"class":173},"67",[144,3284,3263],{"class":157},[144,3286,3164],{"class":150},[144,3288,3289],{"class":173},"69",[144,3291,3263],{"class":157},[144,3293,3164],{"class":150},[144,3295,3296],{"class":173},"76",[144,3298,3263],{"class":157},[144,3300,3164],{"class":150},[144,3302,3303],{"class":173},"65",[144,3305,3263],{"class":157},[144,3307,3164],{"class":150},[144,3309,3310],{"class":173},"6d",[144,3312,3263],{"class":157},[144,3314,3164],{"class":150},[144,3316,3303],{"class":173},[144,3318,3263],{"class":157},[144,3320,3164],{"class":150},[144,3322,3260],{"class":173},[144,3324,3263],{"class":157},[144,3326,3164],{"class":150},[144,3328,3329],{"class":173},"61",[144,3331,3263],{"class":157},[144,3333,3164],{"class":150},[144,3335,3336],{"class":173},"74",[144,3338,3263],{"class":157},[144,3340,3164],{"class":150},[144,3342,3343],{"class":173},"68",[144,3345,3263],{"class":157},[144,3347,3164],{"class":150},[144,3349,3303],{"class":173},[144,3351,3263],{"class":157},[144,3353,3164],{"class":150},[144,3355,3275],{"class":173},[144,3357,3358],{"class":157},"]\n",[144,3360,3361,3364,3367],{"class":146,"line":214},[144,3362,3363],{"class":150},"def",[144,3365,3366],{"class":575}," invert_nibbles",[144,3368,3369],{"class":157},"(b):\n",[144,3371,3372,3374,3377,3379,3381,3384,3386,3388,3390,3392,3394,3396,3398,3401,3403,3405,3407],{"class":146,"line":227},[144,3373,3203],{"class":150},[144,3375,3376],{"class":157}," (b ",[144,3378,1788],{"class":150},[144,3380,1791],{"class":150},[144,3382,3383],{"class":173},"f0",[144,3385,2235],{"class":157},[144,3387,2263],{"class":150},[144,3389,2491],{"class":173},[144,3391,2923],{"class":150},[144,3393,3376],{"class":157},[144,3395,1788],{"class":150},[144,3397,1791],{"class":150},[144,3399,3400],{"class":173},"0f",[144,3402,2235],{"class":157},[144,3404,2488],{"class":150},[144,3406,2491],{"class":173},[144,3408,367],{"class":157},[144,3410,3411],{"class":146,"line":236},[144,3412,240],{"emptyLinePlaceholder":239},[144,3414,3415,3417,3420],{"class":146,"line":243},[144,3416,3363],{"class":150},[144,3418,3419],{"class":575}," main",[144,3421,3422],{"class":157},"():\n",[144,3424,3425,3427,3430,3433,3435,3438],{"class":146,"line":258},[144,3426,1807],{"class":150},[144,3428,3429],{"class":173}," len",[144,3431,3432],{"class":157},"(sys.argv) ",[144,3434,2611],{"class":150},[144,3436,3437],{"class":173}," 2",[144,3439,3440],{"class":157},":\n",[144,3442,3443,3446,3448],{"class":146,"line":269},[144,3444,3445],{"class":157}," sys.exit(",[144,3447,1782],{"class":173},[144,3449,1894],{"class":157},[144,3451,3452],{"class":146,"line":283},[144,3453,240],{"emptyLinePlaceholder":239},[144,3455,3456,3459,3461,3464,3466],{"class":146,"line":300},[144,3457,3458],{"class":157}," pe_path ",[144,3460,1776],{"class":150},[144,3462,3463],{"class":157}," sys.argv[",[144,3465,1782],{"class":173},[144,3467,3358],{"class":157},[144,3469,3470],{"class":146,"line":311},[144,3471,240],{"emptyLinePlaceholder":239},[144,3473,3474,3477],{"class":146,"line":717},[144,3475,3476],{"class":150}," try",[144,3478,3440],{"class":157},[144,3480,3481,3484,3486],{"class":146,"line":730},[144,3482,3483],{"class":157}," pe ",[144,3485,1776],{"class":150},[144,3487,3488],{"class":157}," pefile.PE(pe_path)\n",[144,3490,3491,3494,3497,3500],{"class":146,"line":746},[144,3492,3493],{"class":150}," except",[144,3495,3496],{"class":173}," Exception",[144,3498,3499],{"class":150}," as",[144,3501,3502],{"class":157}," e:\n",[144,3504,3505,3507,3509],{"class":146,"line":768},[144,3506,3445],{"class":157},[144,3508,1782],{"class":173},[144,3510,1894],{"class":157},[144,3512,3513],{"class":146,"line":790},[144,3514,240],{"emptyLinePlaceholder":239},[144,3516,3517,3520,3522],{"class":146,"line":812},[144,3518,3519],{"class":157}," text_section ",[144,3521,1776],{"class":150},[144,3523,3524],{"class":173}," None\n",[144,3526,3527,3530,3533,3536],{"class":146,"line":833},[144,3528,3529],{"class":150}," for",[144,3531,3532],{"class":157}," section ",[144,3534,3535],{"class":150},"in",[144,3537,3538],{"class":157}," pe.sections:\n",[144,3540,3541,3543,3546,3549,3552],{"class":146,"line":854},[144,3542,1831],{"class":150},[144,3544,3545],{"class":150}," b",[144,3547,3548],{"class":2585},"'.text'",[144,3550,3551],{"class":150}," in",[144,3553,3554],{"class":157}," section.Name:\n",[144,3556,3557,3560,3562],{"class":146,"line":876},[144,3558,3559],{"class":157}," text_section ",[144,3561,1776],{"class":150},[144,3563,3564],{"class":157}," section\n",[144,3566,3567],{"class":146,"line":898},[144,3568,3569],{"class":150}," break\n",[144,3571,3572],{"class":146,"line":920},[144,3573,240],{"emptyLinePlaceholder":239},[144,3575,3576,3578,3581,3584,3587],{"class":146,"line":942},[144,3577,1807],{"class":150},[144,3579,3580],{"class":157}," text_section ",[144,3582,3583],{"class":150},"is",[144,3585,3586],{"class":173}," None",[144,3588,3440],{"class":157},[144,3590,3591,3593,3596],{"class":146,"line":964},[144,3592,3445],{"class":157},[144,3594,3595],{"class":173},"2",[144,3597,1894],{"class":157},[144,3599,3600],{"class":146,"line":975},[144,3601,240],{"emptyLinePlaceholder":239},[144,3603,3604,3607,3609,3612],{"class":146,"line":992},[144,3605,3606],{"class":157}," data ",[144,3608,1776],{"class":150},[144,3610,3611],{"class":173}," bytearray",[144,3613,3614],{"class":157},"(text_section.get_data())\n",[144,3616,3617,3620,3622,3625,3628,3630],{"class":146,"line":1011},[144,3618,3619],{"class":157}," pages ",[144,3621,1776],{"class":150},[144,3623,3624],{"class":157}," text_section.SizeOfRawData ",[144,3626,3627],{"class":150},"\u002F\u002F",[144,3629,1791],{"class":150},[144,3631,3632],{"class":173},"1000\n",[144,3634,3635],{"class":146,"line":1030},[144,3636,1568],{"class":157},[144,3638,3639,3641,3644,3646,3649],{"class":146,"line":1049},[144,3640,3529],{"class":150},[144,3642,3643],{"class":157}," i ",[144,3645,3535],{"class":150},[144,3647,3648],{"class":173}," range",[144,3650,3651],{"class":157},"(pages):\n",[144,3653,3654,3657,3659,3661,3663,3665],{"class":146,"line":1068},[144,3655,3656],{"class":157}," offset ",[144,3658,1776],{"class":150},[144,3660,3643],{"class":157},[144,3662,2238],{"class":150},[144,3664,1791],{"class":150},[144,3666,3632],{"class":173},[144,3668,3669,3672,3675,3677,3679,3681,3683,3685],{"class":146,"line":1087},[144,3670,3671],{"class":150}," for",[144,3673,3674],{"class":157}," j ",[144,3676,3535],{"class":150},[144,3678,3648],{"class":173},[144,3680,1816],{"class":157},[144,3682,3164],{"class":150},[144,3684,2743],{"class":173},[144,3686,3687],{"class":157},"):\n",[144,3689,3690,3693,3695,3698,3700,3703,3705],{"class":146,"line":1111},[144,3691,3692],{"class":157}," data[offset ",[144,3694,434],{"class":150},[144,3696,3697],{"class":157}," j] ",[144,3699,1776],{"class":150},[144,3701,3702],{"class":157}," invert_nibbles(data[offset ",[144,3704,434],{"class":150},[144,3706,3707],{"class":157}," j])\n",[144,3709,3710,3712,3714,3716,3719,3722,3725,3727],{"class":146,"line":1133},[144,3711,3692],{"class":157},[144,3713,434],{"class":150},[144,3715,3697],{"class":157},[144,3717,3718],{"class":150},"^=",[144,3720,3721],{"class":157}," key[j ",[144,3723,3724],{"class":150},"%",[144,3726,3429],{"class":173},[144,3728,3729],{"class":157},"(key)]\n",[144,3731,3732],{"class":146,"line":1141},[144,3733,240],{"emptyLinePlaceholder":239},[144,3735,3736,3739,3742],{"class":146,"line":1161},[144,3737,3738],{"class":157}," pe.set_bytes_at_offset(text_section.PointerToRawData, ",[144,3740,3741],{"class":173},"bytes",[144,3743,3744],{"class":157},"(data))\n",[144,3746,3747,3750,3753],{"class":146,"line":1177},[144,3748,3749],{"class":157}," pe.write(",[144,3751,3752],{"class":2585},"'molly_dec.exe'",[144,3754,1894],{"class":157},[144,3756,3757],{"class":146,"line":1196},[144,3758,1802],{"class":157},[144,3760,3761,3763,3766,3769,3772],{"class":146,"line":1215},[144,3762,1734],{"class":150},[144,3764,3765],{"class":173}," __name__",[144,3767,3768],{"class":150}," ==",[144,3770,3771],{"class":2585}," \"__main__\"",[144,3773,3440],{"class":157},[144,3775,3776],{"class":146,"line":1234},[144,3777,3778],{"class":157}," main()\n",[10,3780,3782],{"id":3781},"binary-dynamic-decryption-bonus","Binary Dynamic Decryption (Bonus)",[15,3784,3785,3786,3788],{},"One interesting feature of Molly is its ability to re-encrypt old unlocked pages once the maximum number of decrypted pages has been reached. However, due to the binary’s size and an incorrectly set limit of ",[19,3787,781],{},", Molly allowed 15 pages to remain decrypted, and no re-encryption occurs after the binary exits.",[15,3790,3791],{},[39,3792],{"alt":3793,"src":3794},"encoldpages","\u002Fresources\u002Fmolly\u002Fmolly_encoldpages.png",[15,3796,3797],{},"How can we exploit this behavior?",[15,3799,3800,3801],{},"First, configure x64dbg to establish breakpoints prior to Molly's start and before its termination, and disable the general exception breakpoint.\n",[39,3802],{"alt":3803,"src":3804},"dbg_dumppreparation","\u002Fresources\u002Fmolly\u002Fx64dbg_dump.png",[15,3806,3807,3808],{},"After running Molly, the console should close while the process remains active. Next, open Scylla to dump the process.\n",[39,3809],{"alt":3810,"src":3811},"scylla_dump","\u002Fresources\u002Fmolly\u002FScylla_dump.png",[15,3813,3814],{},"Even if the binary is not fully decrypted, we can still analyze its core components to reconstruct the flag.",[15,3816,3817],{},[39,3818],{"alt":3819,"src":3820},"molly_dump","\u002Fresources\u002Fmolly\u002Fmolly_dump.png",[10,3822,3824],{"id":3823},"binary-analysis","Binary Analysis",[15,3826,3827,3828,194,3831,3834,3835,3838,3839,3842],{},"Upon examining the main function, it becomes clear that Molly compiles and executes a Lua script containing custom functions: ",[19,3829,3830],{},"epic_gaming1",[19,3832,3833],{},"epic_gaming2",", and ",[19,3836,3837],{},"epic_gaming3","; and subsequently defines a global variable ",[19,3840,3841],{},"flag"," with the input provided when running the binary.",[50,3844,3849],{"className":3845,"code":3846,"language":3847,"meta":3848,"style":58},"language-lua shiki shiki-themes github-dark-default","local function a(b)\n local c = {}\n b = b:sub(5, -2)\n for d in string.gmatch(b, \"[^_]+\") do\n table.insert(c, d)\n end\n return c\nend\nlocal function e(f)\n if #f ~= 4 then\n return 1\n end\n local g = 100 + 89 - (84 - 608 \u002F ((945 + 12 + 92 + 65 - 31) \u002F 57) - 23) - 60\n local h = 2370000 \u002F (12 + 93 - 95 \u002F (646 \u002F (85 - 3468 \u002F 68))) \u002F 100 - 52 - 63 - 71\n local i = 149 - (-15 + 8800 \u002F (6248 \u002F (125 - (104 - (17502 \u002F (72 \u002F 12) + 93) \u002F 35 + 36))))\n local j = (52808 \u002F (31 - 1800 \u002F (51 - (95 - 448448 \u002F (147 - 83) \u002F 91) + 42)) - 20) \u002F 66\n if string.char(g, h, i, j) ~= f then\n return 1\n end\n return 0\nend\nlocal k = a(flag) -- split content inside {} by _\nlocal l = epic_gaming2(k[1]) -- run first part check (c side)\nl = l + e(k[2]) -- run second part check (lua side)\nl = l + epic_gaming3(k[3]) -- run third part check (c side)\nl = l + epic_gaming1(k[4]) -- run fourth part check (c side)\nreturn l\n\n","lua","Molly beautified checker script",[19,3850,3851,3865,3878,3903,3926,3934,3939,3946,3951,3963,3981,3988,3992,4073,4148,4232,4316,4334,4340,4344,4351,4355,4372,4395,4417,4440,4462],{"__ignoreMap":58},[144,3852,3853,3856,3859,3862],{"class":146,"line":147},[144,3854,3855],{"class":150},"local",[144,3857,3858],{"class":150}," function",[144,3860,3861],{"class":575}," a",[144,3863,3864],{"class":157},"(b)\n",[144,3866,3867,3870,3873,3875],{"class":146,"line":167},[144,3868,3869],{"class":150}," local",[144,3871,3872],{"class":157}," c ",[144,3874,1776],{"class":150},[144,3876,3877],{"class":157}," {}\n",[144,3879,3880,3883,3885,3887,3889,3891,3893,3895,3897,3899,3901],{"class":146,"line":185},[144,3881,3882],{"class":157}," b ",[144,3884,1776],{"class":150},[144,3886,3545],{"class":2142},[144,3888,135],{"class":157},[144,3890,720],{"class":173},[144,3892,1816],{"class":157},[144,3894,1858],{"class":173},[144,3896,194],{"class":157},[144,3898,676],{"class":150},[144,3900,3595],{"class":173},[144,3902,1894],{"class":157},[144,3904,3905,3907,3910,3912,3915,3918,3921,3923],{"class":146,"line":200},[144,3906,3529],{"class":150},[144,3908,3909],{"class":157}," d ",[144,3911,3535],{"class":150},[144,3913,3914],{"class":173}," string.gmatch",[144,3916,3917],{"class":157},"(b, ",[144,3919,3920],{"class":2585},"\"[^_]+\"",[144,3922,2235],{"class":157},[144,3924,3925],{"class":150},"do\n",[144,3927,3928,3931],{"class":146,"line":214},[144,3929,3930],{"class":173}," table.insert",[144,3932,3933],{"class":157},"(c, d)\n",[144,3935,3936],{"class":146,"line":227},[144,3937,3938],{"class":150}," end\n",[144,3940,3941,3943],{"class":146,"line":236},[144,3942,3203],{"class":150},[144,3944,3945],{"class":157}," c\n",[144,3947,3948],{"class":146,"line":243},[144,3949,3950],{"class":150},"end\n",[144,3952,3953,3955,3957,3960],{"class":146,"line":258},[144,3954,3855],{"class":150},[144,3956,3858],{"class":150},[144,3958,3959],{"class":575}," e",[144,3961,3962],{"class":157},"(f)\n",[144,3964,3965,3967,3970,3973,3976,3978],{"class":146,"line":269},[144,3966,1807],{"class":150},[144,3968,3969],{"class":150}," #",[144,3971,3972],{"class":157},"f ",[144,3974,3975],{"class":150},"~=",[144,3977,2491],{"class":173},[144,3979,3980],{"class":150}," then\n",[144,3982,3983,3985],{"class":146,"line":283},[144,3984,2043],{"class":150},[144,3986,3987],{"class":173}," 1\n",[144,3989,3990],{"class":146,"line":300},[144,3991,3938],{"class":150},[144,3993,3994,3996,3999,4001,4004,4007,4010,4013,4015,4018,4020,4023,4026,4028,4031,4033,4036,4038,4041,4043,4046,4048,4051,4053,4056,4059,4061,4063,4066,4068,4070],{"class":146,"line":311},[144,3995,3869],{"class":150},[144,3997,3998],{"class":157}," g ",[144,4000,1776],{"class":150},[144,4002,4003],{"class":173}," 100",[144,4005,4006],{"class":150}," +",[144,4008,4009],{"class":173}," 89",[144,4011,4012],{"class":150}," -",[144,4014,1810],{"class":157},[144,4016,4017],{"class":173},"84",[144,4019,4012],{"class":150},[144,4021,4022],{"class":173}," 608",[144,4024,4025],{"class":150}," \u002F",[144,4027,2448],{"class":157},[144,4029,4030],{"class":173},"945",[144,4032,4006],{"class":150},[144,4034,4035],{"class":173}," 12",[144,4037,4006],{"class":150},[144,4039,4040],{"class":173}," 92",[144,4042,4006],{"class":150},[144,4044,4045],{"class":173}," 65",[144,4047,4012],{"class":150},[144,4049,4050],{"class":173}," 31",[144,4052,2235],{"class":157},[144,4054,4055],{"class":150},"\u002F",[144,4057,4058],{"class":173}," 57",[144,4060,2235],{"class":157},[144,4062,676],{"class":150},[144,4064,4065],{"class":173}," 23",[144,4067,2235],{"class":157},[144,4069,676],{"class":150},[144,4071,4072],{"class":173}," 60\n",[144,4074,4075,4077,4080,4082,4085,4087,4089,4092,4094,4097,4099,4102,4104,4106,4109,4111,4113,4116,4118,4121,4123,4126,4129,4131,4133,4135,4138,4140,4143,4145],{"class":146,"line":717},[144,4076,3869],{"class":150},[144,4078,4079],{"class":157}," h ",[144,4081,1776],{"class":150},[144,4083,4084],{"class":173}," 2370000",[144,4086,4025],{"class":150},[144,4088,1810],{"class":157},[144,4090,4091],{"class":173},"12",[144,4093,4006],{"class":150},[144,4095,4096],{"class":173}," 93",[144,4098,4012],{"class":150},[144,4100,4101],{"class":173}," 95",[144,4103,4025],{"class":150},[144,4105,1810],{"class":157},[144,4107,4108],{"class":173},"646",[144,4110,4025],{"class":150},[144,4112,1810],{"class":157},[144,4114,4115],{"class":173},"85",[144,4117,4012],{"class":150},[144,4119,4120],{"class":173}," 3468",[144,4122,4025],{"class":150},[144,4124,4125],{"class":173}," 68",[144,4127,4128],{"class":157},"))) ",[144,4130,4055],{"class":150},[144,4132,4003],{"class":173},[144,4134,4012],{"class":150},[144,4136,4137],{"class":173}," 52",[144,4139,4012],{"class":150},[144,4141,4142],{"class":173}," 63",[144,4144,4012],{"class":150},[144,4146,4147],{"class":173}," 71\n",[144,4149,4150,4152,4154,4156,4159,4161,4163,4165,4168,4170,4173,4175,4177,4180,4182,4184,4187,4189,4191,4194,4196,4198,4201,4203,4205,4207,4209,4211,4213,4215,4217,4219,4221,4224,4226,4229],{"class":146,"line":730},[144,4151,3869],{"class":150},[144,4153,3643],{"class":157},[144,4155,1776],{"class":150},[144,4157,4158],{"class":173}," 149",[144,4160,4012],{"class":150},[144,4162,1810],{"class":157},[144,4164,676],{"class":150},[144,4166,4167],{"class":173},"15",[144,4169,4006],{"class":150},[144,4171,4172],{"class":173}," 8800",[144,4174,4025],{"class":150},[144,4176,1810],{"class":157},[144,4178,4179],{"class":173},"6248",[144,4181,4025],{"class":150},[144,4183,1810],{"class":157},[144,4185,4186],{"class":173},"125",[144,4188,4012],{"class":150},[144,4190,1810],{"class":157},[144,4192,4193],{"class":173},"104",[144,4195,4012],{"class":150},[144,4197,1810],{"class":157},[144,4199,4200],{"class":173},"17502",[144,4202,4025],{"class":150},[144,4204,1810],{"class":157},[144,4206,3275],{"class":173},[144,4208,4025],{"class":150},[144,4210,4035],{"class":173},[144,4212,2235],{"class":157},[144,4214,434],{"class":150},[144,4216,4096],{"class":173},[144,4218,2235],{"class":157},[144,4220,4055],{"class":150},[144,4222,4223],{"class":173}," 35",[144,4225,4006],{"class":150},[144,4227,4228],{"class":173}," 36",[144,4230,4231],{"class":157},"))))\n",[144,4233,4234,4236,4238,4240,4242,4245,4247,4249,4252,4254,4257,4259,4261,4264,4266,4268,4271,4273,4276,4278,4280,4283,4285,4288,4290,4292,4295,4297,4299,4302,4304,4306,4309,4311,4313],{"class":146,"line":746},[144,4235,3869],{"class":150},[144,4237,3674],{"class":157},[144,4239,1776],{"class":150},[144,4241,1810],{"class":157},[144,4243,4244],{"class":173},"52808",[144,4246,4025],{"class":150},[144,4248,1810],{"class":157},[144,4250,4251],{"class":173},"31",[144,4253,4012],{"class":150},[144,4255,4256],{"class":173}," 1800",[144,4258,4025],{"class":150},[144,4260,1810],{"class":157},[144,4262,4263],{"class":173},"51",[144,4265,4012],{"class":150},[144,4267,1810],{"class":157},[144,4269,4270],{"class":173},"95",[144,4272,4012],{"class":150},[144,4274,4275],{"class":173}," 448448",[144,4277,4025],{"class":150},[144,4279,1810],{"class":157},[144,4281,4282],{"class":173},"147",[144,4284,4012],{"class":150},[144,4286,4287],{"class":173}," 83",[144,4289,2235],{"class":157},[144,4291,4055],{"class":150},[144,4293,4294],{"class":173}," 91",[144,4296,2235],{"class":157},[144,4298,434],{"class":150},[144,4300,4301],{"class":173}," 42",[144,4303,2269],{"class":157},[144,4305,676],{"class":150},[144,4307,4308],{"class":173}," 20",[144,4310,2235],{"class":157},[144,4312,4055],{"class":150},[144,4314,4315],{"class":173}," 66\n",[144,4317,4318,4320,4323,4326,4328,4331],{"class":146,"line":768},[144,4319,1807],{"class":150},[144,4321,4322],{"class":173}," string.char",[144,4324,4325],{"class":157},"(g, h, i, j) ",[144,4327,3975],{"class":150},[144,4329,4330],{"class":157}," f ",[144,4332,4333],{"class":150},"then\n",[144,4335,4336,4338],{"class":146,"line":790},[144,4337,2043],{"class":150},[144,4339,3987],{"class":173},[144,4341,4342],{"class":146,"line":812},[144,4343,3938],{"class":150},[144,4345,4346,4348],{"class":146,"line":833},[144,4347,3203],{"class":150},[144,4349,4350],{"class":173}," 0\n",[144,4352,4353],{"class":146,"line":854},[144,4354,3950],{"class":150},[144,4356,4357,4359,4362,4364,4366,4369],{"class":146,"line":876},[144,4358,3855],{"class":150},[144,4360,4361],{"class":157}," k ",[144,4363,1776],{"class":150},[144,4365,3861],{"class":173},[144,4367,4368],{"class":157},"(flag) ",[144,4370,4371],{"class":1866},"-- split content inside {} by _\n",[144,4373,4374,4376,4379,4381,4384,4387,4389,4392],{"class":146,"line":898},[144,4375,3855],{"class":150},[144,4377,4378],{"class":157}," l ",[144,4380,1776],{"class":150},[144,4382,4383],{"class":173}," epic_gaming2",[144,4385,4386],{"class":157},"(k[",[144,4388,1782],{"class":173},[144,4390,4391],{"class":157},"]) ",[144,4393,4394],{"class":1866},"-- run first part check (c side)\n",[144,4396,4397,4400,4402,4404,4406,4408,4410,4412,4414],{"class":146,"line":920},[144,4398,4399],{"class":157},"l ",[144,4401,1776],{"class":150},[144,4403,4378],{"class":157},[144,4405,434],{"class":150},[144,4407,3959],{"class":173},[144,4409,4386],{"class":157},[144,4411,3595],{"class":173},[144,4413,4391],{"class":157},[144,4415,4416],{"class":1866},"-- run second part check (lua side)\n",[144,4418,4419,4421,4423,4425,4427,4430,4432,4435,4437],{"class":146,"line":942},[144,4420,4399],{"class":157},[144,4422,1776],{"class":150},[144,4424,4378],{"class":157},[144,4426,434],{"class":150},[144,4428,4429],{"class":173}," epic_gaming3",[144,4431,4386],{"class":157},[144,4433,4434],{"class":173},"3",[144,4436,4391],{"class":157},[144,4438,4439],{"class":1866},"-- run third part check (c side)\n",[144,4441,4442,4444,4446,4448,4450,4453,4455,4457,4459],{"class":146,"line":964},[144,4443,4399],{"class":157},[144,4445,1776],{"class":150},[144,4447,4378],{"class":157},[144,4449,434],{"class":150},[144,4451,4452],{"class":173}," epic_gaming1",[144,4454,4386],{"class":157},[144,4456,2796],{"class":173},[144,4458,4391],{"class":157},[144,4460,4461],{"class":1866},"-- run fourth part check (c side)\n",[144,4463,4464,4466],{"class":146,"line":975},[144,4465,2067],{"class":150},[144,4467,4468],{"class":157}," l\n",[50,4470,4473],{"className":1724,"code":4471,"language":1726,"meta":4472,"style":58},"__int64 __fastcall epic_gaming2(__int64 a1)\n{\n \u002F\u002F ...\n if ( v3 == 7 )\n {\n *(_DWORD *)v10 = 0xEFBEADDE;\n *(_QWORD *)v11 = 0x8DD4BC8B8E9DE8LL;\n v4 = v11;\n v5 = 0;\n v6 = v2 - (_QWORD)v11;\n while ( 1 )\n {\n v7 = v4[v6];\n *v4 ^= v10[v5 & 3];\n\u002F\u002F ...\n return 1LL;\n}\n","epic_gaming2 logic",[19,4474,4475,4490,4494,4499,4515,4520,4542,4566,4576,4587,4602,4614,4618,4631,4653,4658,4669],{"__ignoreMap":58},[144,4476,4477,4480,4482,4485,4488],{"class":146,"line":147},[144,4478,4479],{"class":157},"__int64 __fastcall ",[144,4481,3833],{"class":575},[144,4483,4484],{"class":157},"(__int64 ",[144,4486,4487],{"class":2142},"a1",[144,4489,1894],{"class":157},[144,4491,4492],{"class":146,"line":167},[144,4493,1765],{"class":157},[144,4495,4496],{"class":146,"line":185},[144,4497,4498],{"class":1866}," \u002F\u002F ...\n",[144,4500,4501,4504,4507,4509,4512],{"class":146,"line":200},[144,4502,4503],{"class":150}," if",[144,4505,4506],{"class":157}," ( v3 ",[144,4508,1746],{"class":150},[144,4510,4511],{"class":173}," 7",[144,4513,4514],{"class":157}," )\n",[144,4516,4517],{"class":146,"line":214},[144,4518,4519],{"class":157}," {\n",[144,4521,4522,4525,4528,4530,4533,4535,4537,4540],{"class":146,"line":227},[144,4523,4524],{"class":150}," *",[144,4526,4527],{"class":157},"(_DWORD ",[144,4529,2238],{"class":150},[144,4531,4532],{"class":157},")v10 ",[144,4534,1776],{"class":150},[144,4536,1791],{"class":150},[144,4538,4539],{"class":173},"EFBEADDE",[144,4541,1797],{"class":157},[144,4543,4544,4546,4549,4551,4554,4556,4558,4561,4564],{"class":146,"line":236},[144,4545,4524],{"class":150},[144,4547,4548],{"class":157},"(_QWORD ",[144,4550,2238],{"class":150},[144,4552,4553],{"class":157},")v11 ",[144,4555,1776],{"class":150},[144,4557,1791],{"class":150},[144,4559,4560],{"class":173},"8DD4BC8B8E9DE8",[144,4562,4563],{"class":150},"LL",[144,4565,1797],{"class":157},[144,4567,4568,4571,4573],{"class":146,"line":243},[144,4569,4570],{"class":157}," v4 ",[144,4572,1776],{"class":150},[144,4574,4575],{"class":157}," v11;\n",[144,4577,4578,4581,4583,4585],{"class":146,"line":258},[144,4579,4580],{"class":157}," v5 ",[144,4582,1776],{"class":150},[144,4584,1989],{"class":173},[144,4586,1797],{"class":157},[144,4588,4589,4592,4594,4597,4599],{"class":146,"line":269},[144,4590,4591],{"class":157}," v6 ",[144,4593,1776],{"class":150},[144,4595,4596],{"class":157}," v2 ",[144,4598,676],{"class":150},[144,4600,4601],{"class":157}," (_QWORD)v11;\n",[144,4603,4604,4607,4610,4612],{"class":146,"line":283},[144,4605,4606],{"class":150}," while",[144,4608,4609],{"class":157}," ( ",[144,4611,1782],{"class":173},[144,4613,4514],{"class":157},[144,4615,4616],{"class":146,"line":300},[144,4617,1826],{"class":157},[144,4619,4620,4623,4625,4628],{"class":146,"line":311},[144,4621,4622],{"class":157}," v7 ",[144,4624,1776],{"class":150},[144,4626,4627],{"class":2142}," v4",[144,4629,4630],{"class":157},"[v6];\n",[144,4632,4633,4636,4639,4641,4644,4647,4649,4651],{"class":146,"line":717},[144,4634,4635],{"class":150}," *",[144,4637,4638],{"class":157},"v4 ",[144,4640,3718],{"class":150},[144,4642,4643],{"class":2142}," v10",[144,4645,4646],{"class":157},"[v5 ",[144,4648,1788],{"class":150},[144,4650,3060],{"class":173},[144,4652,2534],{"class":157},[144,4654,4655],{"class":146,"line":730},[144,4656,4657],{"class":1866},"\u002F\u002F ...\n",[144,4659,4660,4663,4665,4667],{"class":146,"line":746},[144,4661,4662],{"class":150}," return",[144,4664,2890],{"class":173},[144,4666,4563],{"class":150},[144,4668,1797],{"class":157},[144,4670,4671],{"class":146,"line":768},[144,4672,486],{"class":157},[50,4674,4677],{"className":3223,"code":4675,"language":3225,"meta":4676,"style":58},"# epic_gaming2 solve\nxored = b\"\\xe8\\x9d\\x8e\\x8b\\xbc\\xd4\\x8d\"\nkey = [ 0xDE, 0xAD, 0xBE, 0xEF ]\n\npart1 = [ xored[i] ^ key[i % len(key)] for i in range(len(xored)) ]\n \nprint(''.join([chr(c) for c in part1])) # 600dby3\n","epic_gaming2 solve",[19,4678,4679,4684,4702,4740,4744,4783,4787],{"__ignoreMap":58},[144,4680,4681],{"class":146,"line":147},[144,4682,4683],{"class":1866},"# epic_gaming2 solve\n",[144,4685,4686,4689,4691,4693,4696,4699],{"class":146,"line":167},[144,4687,4688],{"class":157},"xored ",[144,4690,1776],{"class":150},[144,4692,3545],{"class":150},[144,4694,4695],{"class":2585},"\"",[144,4697,4698],{"class":150},"\\xe8\\x9d\\x8e\\x8b\\xbc\\xd4\\x8d",[144,4700,4701],{"class":2585},"\"\n",[144,4703,4704,4706,4708,4711,4713,4716,4718,4720,4723,4725,4727,4730,4732,4734,4737],{"class":146,"line":185},[144,4705,3251],{"class":157},[144,4707,1776],{"class":150},[144,4709,4710],{"class":157}," [ ",[144,4712,3164],{"class":150},[144,4714,4715],{"class":173},"DE",[144,4717,194],{"class":157},[144,4719,3164],{"class":150},[144,4721,4722],{"class":173},"AD",[144,4724,194],{"class":157},[144,4726,3164],{"class":150},[144,4728,4729],{"class":173},"BE",[144,4731,194],{"class":157},[144,4733,3164],{"class":150},[144,4735,4736],{"class":173},"EF",[144,4738,4739],{"class":157}," ]\n",[144,4741,4742],{"class":146,"line":200},[144,4743,240],{"emptyLinePlaceholder":239},[144,4745,4746,4749,4751,4754,4756,4759,4761,4763,4766,4769,4771,4773,4775,4777,4780],{"class":146,"line":214},[144,4747,4748],{"class":157},"part1 ",[144,4750,1776],{"class":150},[144,4752,4753],{"class":157}," [ xored[i] ",[144,4755,2227],{"class":150},[144,4757,4758],{"class":157}," key[i ",[144,4760,3724],{"class":150},[144,4762,3429],{"class":173},[144,4764,4765],{"class":157},"(key)] ",[144,4767,4768],{"class":150},"for",[144,4770,3643],{"class":157},[144,4772,3535],{"class":150},[144,4774,3648],{"class":173},[144,4776,1816],{"class":157},[144,4778,4779],{"class":173},"len",[144,4781,4782],{"class":157},"(xored)) ]\n",[144,4784,4785],{"class":146,"line":227},[144,4786,1802],{"class":157},[144,4788,4789,4792,4794,4797,4800,4803,4806,4808,4810,4812,4815],{"class":146,"line":236},[144,4790,4791],{"class":173},"print",[144,4793,1816],{"class":157},[144,4795,4796],{"class":2585},"''",[144,4798,4799],{"class":157},".join([",[144,4801,4802],{"class":173},"chr",[144,4804,4805],{"class":157},"(c) ",[144,4807,4768],{"class":150},[144,4809,3872],{"class":157},[144,4811,3535],{"class":150},[144,4813,4814],{"class":157}," part1])) ",[144,4816,4817],{"class":1866},"# 600dby3\n",[2099,4819,4820],{},[15,4821,4822],{},[19,4823,4824],{},"600dby3",[50,4826,4829],{"className":3845,"code":4827,"language":3847,"meta":4828,"style":58},"local g = 100 + 89 - (84 - 608 \u002F ((945 + 12 + 92 + 65 - 31) \u002F 57) - 23) - 60\nlocal h = 2370000 \u002F (12 + 93 - 95 \u002F (646 \u002F (85 - 3468 \u002F 68))) \u002F 100 - 52 - 63 - 71\nlocal i = 149 - (-15 + 8800 \u002F (6248 \u002F (125 - (104 - (17502 \u002F (72 \u002F 12) + 93) \u002F 35 + 36))))\nlocal j = (52808 \u002F (31 - 1800 \u002F (51 - (95 - 448448 \u002F (147 - 83) \u002F 91) + 42)) - 20) \u002F 66\nprint(string.char(g, h, i, j))\n","lua func solve",[19,4830,4831,4895,4957,5031,5103],{"__ignoreMap":58},[144,4832,4833,4835,4837,4839,4841,4843,4845,4847,4849,4851,4853,4855,4857,4859,4861,4863,4865,4867,4869,4871,4873,4875,4877,4879,4881,4883,4885,4887,4889,4891,4893],{"class":146,"line":147},[144,4834,3855],{"class":150},[144,4836,3998],{"class":157},[144,4838,1776],{"class":150},[144,4840,4003],{"class":173},[144,4842,4006],{"class":150},[144,4844,4009],{"class":173},[144,4846,4012],{"class":150},[144,4848,1810],{"class":157},[144,4850,4017],{"class":173},[144,4852,4012],{"class":150},[144,4854,4022],{"class":173},[144,4856,4025],{"class":150},[144,4858,2448],{"class":157},[144,4860,4030],{"class":173},[144,4862,4006],{"class":150},[144,4864,4035],{"class":173},[144,4866,4006],{"class":150},[144,4868,4040],{"class":173},[144,4870,4006],{"class":150},[144,4872,4045],{"class":173},[144,4874,4012],{"class":150},[144,4876,4050],{"class":173},[144,4878,2235],{"class":157},[144,4880,4055],{"class":150},[144,4882,4058],{"class":173},[144,4884,2235],{"class":157},[144,4886,676],{"class":150},[144,4888,4065],{"class":173},[144,4890,2235],{"class":157},[144,4892,676],{"class":150},[144,4894,4072],{"class":173},[144,4896,4897,4899,4901,4903,4905,4907,4909,4911,4913,4915,4917,4919,4921,4923,4925,4927,4929,4931,4933,4935,4937,4939,4941,4943,4945,4947,4949,4951,4953,4955],{"class":146,"line":167},[144,4898,3855],{"class":150},[144,4900,4079],{"class":157},[144,4902,1776],{"class":150},[144,4904,4084],{"class":173},[144,4906,4025],{"class":150},[144,4908,1810],{"class":157},[144,4910,4091],{"class":173},[144,4912,4006],{"class":150},[144,4914,4096],{"class":173},[144,4916,4012],{"class":150},[144,4918,4101],{"class":173},[144,4920,4025],{"class":150},[144,4922,1810],{"class":157},[144,4924,4108],{"class":173},[144,4926,4025],{"class":150},[144,4928,1810],{"class":157},[144,4930,4115],{"class":173},[144,4932,4012],{"class":150},[144,4934,4120],{"class":173},[144,4936,4025],{"class":150},[144,4938,4125],{"class":173},[144,4940,4128],{"class":157},[144,4942,4055],{"class":150},[144,4944,4003],{"class":173},[144,4946,4012],{"class":150},[144,4948,4137],{"class":173},[144,4950,4012],{"class":150},[144,4952,4142],{"class":173},[144,4954,4012],{"class":150},[144,4956,4147],{"class":173},[144,4958,4959,4961,4963,4965,4967,4969,4971,4973,4975,4977,4979,4981,4983,4985,4987,4989,4991,4993,4995,4997,4999,5001,5003,5005,5007,5009,5011,5013,5015,5017,5019,5021,5023,5025,5027,5029],{"class":146,"line":185},[144,4960,3855],{"class":150},[144,4962,3643],{"class":157},[144,4964,1776],{"class":150},[144,4966,4158],{"class":173},[144,4968,4012],{"class":150},[144,4970,1810],{"class":157},[144,4972,676],{"class":150},[144,4974,4167],{"class":173},[144,4976,4006],{"class":150},[144,4978,4172],{"class":173},[144,4980,4025],{"class":150},[144,4982,1810],{"class":157},[144,4984,4179],{"class":173},[144,4986,4025],{"class":150},[144,4988,1810],{"class":157},[144,4990,4186],{"class":173},[144,4992,4012],{"class":150},[144,4994,1810],{"class":157},[144,4996,4193],{"class":173},[144,4998,4012],{"class":150},[144,5000,1810],{"class":157},[144,5002,4200],{"class":173},[144,5004,4025],{"class":150},[144,5006,1810],{"class":157},[144,5008,3275],{"class":173},[144,5010,4025],{"class":150},[144,5012,4035],{"class":173},[144,5014,2235],{"class":157},[144,5016,434],{"class":150},[144,5018,4096],{"class":173},[144,5020,2235],{"class":157},[144,5022,4055],{"class":150},[144,5024,4223],{"class":173},[144,5026,4006],{"class":150},[144,5028,4228],{"class":173},[144,5030,4231],{"class":157},[144,5032,5033,5035,5037,5039,5041,5043,5045,5047,5049,5051,5053,5055,5057,5059,5061,5063,5065,5067,5069,5071,5073,5075,5077,5079,5081,5083,5085,5087,5089,5091,5093,5095,5097,5099,5101],{"class":146,"line":200},[144,5034,3855],{"class":150},[144,5036,3674],{"class":157},[144,5038,1776],{"class":150},[144,5040,1810],{"class":157},[144,5042,4244],{"class":173},[144,5044,4025],{"class":150},[144,5046,1810],{"class":157},[144,5048,4251],{"class":173},[144,5050,4012],{"class":150},[144,5052,4256],{"class":173},[144,5054,4025],{"class":150},[144,5056,1810],{"class":157},[144,5058,4263],{"class":173},[144,5060,4012],{"class":150},[144,5062,1810],{"class":157},[144,5064,4270],{"class":173},[144,5066,4012],{"class":150},[144,5068,4275],{"class":173},[144,5070,4025],{"class":150},[144,5072,1810],{"class":157},[144,5074,4282],{"class":173},[144,5076,4012],{"class":150},[144,5078,4287],{"class":173},[144,5080,2235],{"class":157},[144,5082,4055],{"class":150},[144,5084,4294],{"class":173},[144,5086,2235],{"class":157},[144,5088,434],{"class":150},[144,5090,4301],{"class":173},[144,5092,2269],{"class":157},[144,5094,676],{"class":150},[144,5096,4308],{"class":173},[144,5098,2235],{"class":157},[144,5100,4055],{"class":150},[144,5102,4315],{"class":173},[144,5104,5105,5107,5109,5112],{"class":146,"line":214},[144,5106,4791],{"class":173},[144,5108,1816],{"class":157},[144,5110,5111],{"class":173},"string.char",[144,5113,5114],{"class":157},"(g, h, i, j))\n",[2099,5116,5117],{},[15,5118,5119],{},[19,5120,5121],{},"d3@r",[50,5123,5125],{"className":1724,"code":5124,"language":1726,"meta":3837,"style":58},"&& ((unsigned __int16)v2[1] | (unsigned __int16)(*v2 \u003C\u003C 8)) == COERCE_INT('0p')\n && ((unsigned __int16)v2[3] | (unsigned __int16)(v2[2] \u003C\u003C 8)) == COERCE_INT('3n')\n && ((unsigned __int16)v2[5] | (unsigned __int16)(v2[4] \u003C\u003C 8)) == COERCE_INT('50')\n && ((unsigned __int16)v2[7] | (unsigned __int16)(v2[6] \u003C\u003C 8)) == COERCE_INT('ur')\n && ((unsigned __int16)v2[9] | (unsigned __int16)(v2[8] \u003C\u003C 8)) == COERCE_INT('c3') )\n",[19,5126,5127,5181,5233,5284,5336],{"__ignoreMap":58},[144,5128,5129,5131,5133,5136,5139,5142,5144,5146,5148,5151,5153,5155,5158,5160,5163,5165,5167,5169,5171,5174,5176,5179],{"class":146,"line":147},[144,5130,1752],{"class":150},[144,5132,2448],{"class":157},[144,5134,5135],{"class":150},"unsigned",[144,5137,5138],{"class":157}," __int16)",[144,5140,5141],{"class":2142},"v2",[144,5143,2529],{"class":157},[144,5145,1782],{"class":173},[144,5147,1785],{"class":157},[144,5149,5150],{"class":150},"|",[144,5152,1810],{"class":157},[144,5154,5135],{"class":150},[144,5156,5157],{"class":157}," __int16)(",[144,5159,2238],{"class":150},[144,5161,5162],{"class":157},"v2 ",[144,5164,2488],{"class":150},[144,5166,2266],{"class":173},[144,5168,2269],{"class":157},[144,5170,1746],{"class":150},[144,5172,5173],{"class":575}," COERCE_INT",[144,5175,1816],{"class":157},[144,5177,5178],{"class":2585},"'0p'",[144,5180,1894],{"class":157},[144,5182,5183,5186,5188,5190,5192,5194,5196,5198,5200,5202,5204,5206,5208,5210,5212,5214,5216,5218,5220,5222,5224,5226,5228,5231],{"class":146,"line":167},[144,5184,5185],{"class":150}," &&",[144,5187,2448],{"class":157},[144,5189,5135],{"class":150},[144,5191,5138],{"class":157},[144,5193,5141],{"class":2142},[144,5195,2529],{"class":157},[144,5197,4434],{"class":173},[144,5199,1785],{"class":157},[144,5201,5150],{"class":150},[144,5203,1810],{"class":157},[144,5205,5135],{"class":150},[144,5207,5157],{"class":157},[144,5209,5141],{"class":2142},[144,5211,2529],{"class":157},[144,5213,3595],{"class":173},[144,5215,1785],{"class":157},[144,5217,2488],{"class":150},[144,5219,2266],{"class":173},[144,5221,2269],{"class":157},[144,5223,1746],{"class":150},[144,5225,5173],{"class":575},[144,5227,1816],{"class":157},[144,5229,5230],{"class":2585},"'3n'",[144,5232,1894],{"class":157},[144,5234,5235,5237,5239,5241,5243,5245,5247,5249,5251,5253,5255,5257,5259,5261,5263,5265,5267,5269,5271,5273,5275,5277,5279,5282],{"class":146,"line":185},[144,5236,5185],{"class":150},[144,5238,2448],{"class":157},[144,5240,5135],{"class":150},[144,5242,5138],{"class":157},[144,5244,5141],{"class":2142},[144,5246,2529],{"class":157},[144,5248,1858],{"class":173},[144,5250,1785],{"class":157},[144,5252,5150],{"class":150},[144,5254,1810],{"class":157},[144,5256,5135],{"class":150},[144,5258,5157],{"class":157},[144,5260,5141],{"class":2142},[144,5262,2529],{"class":157},[144,5264,2796],{"class":173},[144,5266,1785],{"class":157},[144,5268,2488],{"class":150},[144,5270,2266],{"class":173},[144,5272,2269],{"class":157},[144,5274,1746],{"class":150},[144,5276,5173],{"class":575},[144,5278,1816],{"class":157},[144,5280,5281],{"class":2585},"'50'",[144,5283,1894],{"class":157},[144,5285,5286,5288,5290,5292,5294,5296,5298,5301,5303,5305,5307,5309,5311,5313,5315,5317,5319,5321,5323,5325,5327,5329,5331,5334],{"class":146,"line":200},[144,5287,5185],{"class":150},[144,5289,2448],{"class":157},[144,5291,5135],{"class":150},[144,5293,5138],{"class":157},[144,5295,5141],{"class":2142},[144,5297,2529],{"class":157},[144,5299,5300],{"class":173},"7",[144,5302,1785],{"class":157},[144,5304,5150],{"class":150},[144,5306,1810],{"class":157},[144,5308,5135],{"class":150},[144,5310,5157],{"class":157},[144,5312,5141],{"class":2142},[144,5314,2529],{"class":157},[144,5316,1921],{"class":173},[144,5318,1785],{"class":157},[144,5320,2488],{"class":150},[144,5322,2266],{"class":173},[144,5324,2269],{"class":157},[144,5326,1746],{"class":150},[144,5328,5173],{"class":575},[144,5330,1816],{"class":157},[144,5332,5333],{"class":2585},"'ur'",[144,5335,1894],{"class":157},[144,5337,5338,5340,5342,5344,5346,5348,5350,5353,5355,5357,5359,5361,5363,5365,5367,5370,5372,5374,5376,5378,5380,5382,5384,5387],{"class":146,"line":214},[144,5339,5185],{"class":150},[144,5341,2448],{"class":157},[144,5343,5135],{"class":150},[144,5345,5138],{"class":157},[144,5347,5141],{"class":2142},[144,5349,2529],{"class":157},[144,5351,5352],{"class":173},"9",[144,5354,1785],{"class":157},[144,5356,5150],{"class":150},[144,5358,1810],{"class":157},[144,5360,5135],{"class":150},[144,5362,5157],{"class":157},[144,5364,5141],{"class":2142},[144,5366,2529],{"class":157},[144,5368,5369],{"class":173},"8",[144,5371,1785],{"class":157},[144,5373,2488],{"class":150},[144,5375,2266],{"class":173},[144,5377,2269],{"class":157},[144,5379,1746],{"class":150},[144,5381,5173],{"class":575},[144,5383,1816],{"class":157},[144,5385,5386],{"class":2585},"'c3'",[144,5388,5389],{"class":157},") )\n",[2099,5391,5392],{},[15,5393,5394],{},[19,5395,5396],{},"0p3n50urc3",[50,5398,5400],{"className":3223,"code":5399,"language":3225,"meta":3830,"style":58},"text = \"0n0_d@y_w3_w1ll_m33t\"\ntext += \" \" * (44 - len(text))\npart2_c = [0, 182, 260, 429, 796, 680, 1188, 1043, 1560, 1548, 1520, 2618, 1656, 2548, 2604, 2145, 3184, 2346, 2250, 4332, 2600, 2877, 1870, 3174, 3120, 2050, 2080, 4050, 3668, 4089, 3060, 2573, 3456, 2673, 3876, 4270, 4716, 2960, 4180, 4212, 4400, 4141, 6216, 3612]\nprint(part2_c[:44])\npart2 = \"\"\n\nfrom string import printable\nfor i in range(1, 44):\n sum = part2_c[i] \u002F i\n for c in printable:\n if ord(c) + ord(text[i]) == sum:\n part2 += c\n break\n\n# aHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3L1RZc0NLNEt4 => base64 => \"https...\"\npart2 = \"a\" + part2 \nprint(part2)\n",[19,5401,5402,5412,5435,5664,5676,5686,5690,5703,5723,5739,5750,5773,5782,5786,5790,5795,5809],{"__ignoreMap":58},[144,5403,5404,5407,5409],{"class":146,"line":147},[144,5405,5406],{"class":157},"text ",[144,5408,1776],{"class":150},[144,5410,5411],{"class":2585}," \"0n0_d@y_w3_w1ll_m33t\"\n",[144,5413,5414,5416,5418,5421,5423,5425,5428,5430,5432],{"class":146,"line":167},[144,5415,5406],{"class":157},[144,5417,2887],{"class":150},[144,5419,5420],{"class":2585}," \" \"",[144,5422,2498],{"class":150},[144,5424,1810],{"class":157},[144,5426,5427],{"class":173},"44",[144,5429,4012],{"class":150},[144,5431,3429],{"class":173},[144,5433,5434],{"class":157},"(text))\n",[144,5436,5437,5440,5442,5444,5447,5449,5452,5454,5457,5459,5462,5464,5467,5469,5472,5474,5477,5479,5482,5484,5487,5489,5492,5494,5497,5499,5502,5504,5507,5509,5512,5514,5517,5519,5522,5524,5527,5529,5532,5534,5537,5539,5542,5544,5547,5549,5552,5554,5557,5559,5562,5564,5567,5569,5572,5574,5577,5579,5582,5584,5587,5589,5592,5594,5597,5599,5602,5604,5607,5609,5612,5614,5617,5619,5622,5624,5627,5629,5632,5634,5637,5639,5642,5644,5647,5649,5652,5654,5657,5659,5662],{"class":146,"line":185},[144,5438,5439],{"class":157},"part2_c ",[144,5441,1776],{"class":150},[144,5443,158],{"class":157},[144,5445,5446],{"class":173},"0",[144,5448,194],{"class":157},[144,5450,5451],{"class":173},"182",[144,5453,194],{"class":157},[144,5455,5456],{"class":173},"260",[144,5458,194],{"class":157},[144,5460,5461],{"class":173},"429",[144,5463,194],{"class":157},[144,5465,5466],{"class":173},"796",[144,5468,194],{"class":157},[144,5470,5471],{"class":173},"680",[144,5473,194],{"class":157},[144,5475,5476],{"class":173},"1188",[144,5478,194],{"class":157},[144,5480,5481],{"class":173},"1043",[144,5483,194],{"class":157},[144,5485,5486],{"class":173},"1560",[144,5488,194],{"class":157},[144,5490,5491],{"class":173},"1548",[144,5493,194],{"class":157},[144,5495,5496],{"class":173},"1520",[144,5498,194],{"class":157},[144,5500,5501],{"class":173},"2618",[144,5503,194],{"class":157},[144,5505,5506],{"class":173},"1656",[144,5508,194],{"class":157},[144,5510,5511],{"class":173},"2548",[144,5513,194],{"class":157},[144,5515,5516],{"class":173},"2604",[144,5518,194],{"class":157},[144,5520,5521],{"class":173},"2145",[144,5523,194],{"class":157},[144,5525,5526],{"class":173},"3184",[144,5528,194],{"class":157},[144,5530,5531],{"class":173},"2346",[144,5533,194],{"class":157},[144,5535,5536],{"class":173},"2250",[144,5538,194],{"class":157},[144,5540,5541],{"class":173},"4332",[144,5543,194],{"class":157},[144,5545,5546],{"class":173},"2600",[144,5548,194],{"class":157},[144,5550,5551],{"class":173},"2877",[144,5553,194],{"class":157},[144,5555,5556],{"class":173},"1870",[144,5558,194],{"class":157},[144,5560,5561],{"class":173},"3174",[144,5563,194],{"class":157},[144,5565,5566],{"class":173},"3120",[144,5568,194],{"class":157},[144,5570,5571],{"class":173},"2050",[144,5573,194],{"class":157},[144,5575,5576],{"class":173},"2080",[144,5578,194],{"class":157},[144,5580,5581],{"class":173},"4050",[144,5583,194],{"class":157},[144,5585,5586],{"class":173},"3668",[144,5588,194],{"class":157},[144,5590,5591],{"class":173},"4089",[144,5593,194],{"class":157},[144,5595,5596],{"class":173},"3060",[144,5598,194],{"class":157},[144,5600,5601],{"class":173},"2573",[144,5603,194],{"class":157},[144,5605,5606],{"class":173},"3456",[144,5608,194],{"class":157},[144,5610,5611],{"class":173},"2673",[144,5613,194],{"class":157},[144,5615,5616],{"class":173},"3876",[144,5618,194],{"class":157},[144,5620,5621],{"class":173},"4270",[144,5623,194],{"class":157},[144,5625,5626],{"class":173},"4716",[144,5628,194],{"class":157},[144,5630,5631],{"class":173},"2960",[144,5633,194],{"class":157},[144,5635,5636],{"class":173},"4180",[144,5638,194],{"class":157},[144,5640,5641],{"class":173},"4212",[144,5643,194],{"class":157},[144,5645,5646],{"class":173},"4400",[144,5648,194],{"class":157},[144,5650,5651],{"class":173},"4141",[144,5653,194],{"class":157},[144,5655,5656],{"class":173},"6216",[144,5658,194],{"class":157},[144,5660,5661],{"class":173},"3612",[144,5663,3358],{"class":157},[144,5665,5666,5668,5671,5673],{"class":146,"line":200},[144,5667,4791],{"class":173},[144,5669,5670],{"class":157},"(part2_c[:",[144,5672,5427],{"class":173},[144,5674,5675],{"class":157},"])\n",[144,5677,5678,5681,5683],{"class":146,"line":214},[144,5679,5680],{"class":157},"part2 ",[144,5682,1776],{"class":150},[144,5684,5685],{"class":2585}," \"\"\n",[144,5687,5688],{"class":146,"line":227},[144,5689,240],{"emptyLinePlaceholder":239},[144,5691,5692,5695,5698,5700],{"class":146,"line":236},[144,5693,5694],{"class":150},"from",[144,5696,5697],{"class":157}," string ",[144,5699,3232],{"class":150},[144,5701,5702],{"class":157}," printable\n",[144,5704,5705,5707,5709,5711,5713,5715,5717,5719,5721],{"class":146,"line":243},[144,5706,4768],{"class":150},[144,5708,3643],{"class":157},[144,5710,3535],{"class":150},[144,5712,3648],{"class":173},[144,5714,1816],{"class":157},[144,5716,1782],{"class":173},[144,5718,194],{"class":157},[144,5720,5427],{"class":173},[144,5722,3687],{"class":157},[144,5724,5725,5728,5731,5734,5736],{"class":146,"line":258},[144,5726,5727],{"class":173}," sum",[144,5729,5730],{"class":150}," =",[144,5732,5733],{"class":157}," part2_c[i] ",[144,5735,4055],{"class":150},[144,5737,5738],{"class":157}," i\n",[144,5740,5741,5743,5745,5747],{"class":146,"line":269},[144,5742,3529],{"class":150},[144,5744,3872],{"class":157},[144,5746,3535],{"class":150},[144,5748,5749],{"class":157}," printable:\n",[144,5751,5752,5754,5757,5759,5761,5763,5766,5768,5771],{"class":146,"line":283},[144,5753,1831],{"class":150},[144,5755,5756],{"class":173}," ord",[144,5758,4805],{"class":157},[144,5760,434],{"class":150},[144,5762,5756],{"class":173},[144,5764,5765],{"class":157},"(text[i]) ",[144,5767,1746],{"class":150},[144,5769,5770],{"class":173}," sum",[144,5772,3440],{"class":157},[144,5774,5775,5778,5780],{"class":146,"line":300},[144,5776,5777],{"class":157}," part2 ",[144,5779,2887],{"class":150},[144,5781,3945],{"class":157},[144,5783,5784],{"class":146,"line":311},[144,5785,3569],{"class":150},[144,5787,5788],{"class":146,"line":717},[144,5789,240],{"emptyLinePlaceholder":239},[144,5791,5792],{"class":146,"line":730},[144,5793,5794],{"class":1866},"# aHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3L1RZc0NLNEt4 => base64 => \"https...\"\n",[144,5796,5797,5799,5801,5804,5806],{"class":146,"line":746},[144,5798,5680],{"class":157},[144,5800,1776],{"class":150},[144,5802,5803],{"class":2585}," \"a\"",[144,5805,4006],{"class":150},[144,5807,5808],{"class":157}," part2 \n",[144,5810,5811,5813],{"class":146,"line":768},[144,5812,4791],{"class":173},[144,5814,5815],{"class":157},"(part2)\n",[2099,5817,5818],{},[15,5819,5820],{},[19,5821,5822],{},"aHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3L1RZc0NLNEt4",[15,5824,5825,5826],{},"Final flag is ",[19,5827,5828],{},"TRX{600dby3_d3@r_0p3n50urc3_aHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3L1RZc0NLNEt4}",[10,5830,5832],{"id":5831},"molly-revenge","Molly Revenge",[15,5834,5835],{},"Due to Molly dynamic dumping approach, Molly Revenge presents a hardened version of Molly, incorporating anti-debug checks, an new encryption\u002Fdecryption routine, fewer unlocked pages limit, and rigorous flag integrity verification.",[10,5837,5839],{"id":5838},"molly-revenge-decryptor","Molly Revenge Decryptor",[50,5841,5844],{"className":3223,"code":5842,"language":3225,"meta":5843,"style":58},"import sys\nimport pefile\nfrom Crypto.Cipher import ChaCha20\n\nchacha_key = bytes([\n 81, 90, 238, 246,\n 49, 96, 101, 57,\n 154, 226, 109, 170,\n 143, 34, 55, 109,\n 174, 11, 21, 112,\n 250, 101, 27, 136,\n 129, 218, 111, 100,\n 38, 121, 11, 3\n])\nchacha_nonce = bytes([0xd0, 0, 0, 0, 0, 0, 0, 0])\n\ndef main():\n if len(sys.argv) != 2:\n sys.exit(1)\n\n pe_path = sys.argv[1]\n\n try:\n pe = pefile.PE(pe_path)\n except Exception as e:\n sys.exit(1)\n\n text_section = None\n for section in pe.sections:\n if b'.text' in section.Name:\n text_section = section\n break\n\n if text_section is None:\n sys.exit(2)\n\n data = bytearray(text_section.get_data())\n pages = text_section.SizeOfRawData \u002F\u002F 0x1000\n \n \n for i in range(pages):\n offset = i * 0x1000\n cipher = ChaCha20.new(key=chacha_key, nonce=chacha_nonce) # fancy way to use ChaCha20 since nonce doesn't change\n data[offset:offset + 0x1000] = bytearray(cipher.decrypt(data[offset:offset + 0x1000]))\n \n\n pe.set_bytes_at_offset(text_section.PointerToRawData, bytes(data))\n pe.write('molly_revenge_dec.exe')\n \nif __name__ == \"__main__\":\n main()\n","Example of Molly Revenge decryptor",[19,5845,5846,5852,5858,5870,5874,5887,5910,5932,5954,5975,5997,6018,6040,6059,6063,6110,6114,6122,6136,6144,6148,6160,6164,6170,6178,6188,6196,6200,6208,6218,6230,6238,6242,6246,6258,6266,6270,6280,6294,6298,6302,6314,6328,6357,6386,6390,6394,6402,6411,6415,6427],{"__ignoreMap":58},[144,5847,5848,5850],{"class":146,"line":147},[144,5849,3232],{"class":150},[144,5851,3235],{"class":157},[144,5853,5854,5856],{"class":146,"line":167},[144,5855,3232],{"class":150},[144,5857,3242],{"class":157},[144,5859,5860,5862,5865,5867],{"class":146,"line":185},[144,5861,5694],{"class":150},[144,5863,5864],{"class":157}," Crypto.Cipher ",[144,5866,3232],{"class":150},[144,5868,5869],{"class":157}," ChaCha20\n",[144,5871,5872],{"class":146,"line":200},[144,5873,240],{"emptyLinePlaceholder":239},[144,5875,5876,5879,5881,5884],{"class":146,"line":214},[144,5877,5878],{"class":157},"chacha_key ",[144,5880,1776],{"class":150},[144,5882,5883],{"class":173}," bytes",[144,5885,5886],{"class":157},"([\n",[144,5888,5889,5892,5894,5897,5899,5902,5904,5907],{"class":146,"line":227},[144,5890,5891],{"class":173}," 81",[144,5893,194],{"class":157},[144,5895,5896],{"class":173},"90",[144,5898,194],{"class":157},[144,5900,5901],{"class":173},"238",[144,5903,194],{"class":157},[144,5905,5906],{"class":173},"246",[144,5908,5909],{"class":157},",\n",[144,5911,5912,5915,5917,5920,5922,5925,5927,5930],{"class":146,"line":236},[144,5913,5914],{"class":173}," 49",[144,5916,194],{"class":157},[144,5918,5919],{"class":173},"96",[144,5921,194],{"class":157},[144,5923,5924],{"class":173},"101",[144,5926,194],{"class":157},[144,5928,5929],{"class":173},"57",[144,5931,5909],{"class":157},[144,5933,5934,5937,5939,5942,5944,5947,5949,5952],{"class":146,"line":243},[144,5935,5936],{"class":173}," 154",[144,5938,194],{"class":157},[144,5940,5941],{"class":173},"226",[144,5943,194],{"class":157},[144,5945,5946],{"class":173},"109",[144,5948,194],{"class":157},[144,5950,5951],{"class":173},"170",[144,5953,5909],{"class":157},[144,5955,5956,5959,5961,5964,5966,5969,5971,5973],{"class":146,"line":258},[144,5957,5958],{"class":173}," 143",[144,5960,194],{"class":157},[144,5962,5963],{"class":173},"34",[144,5965,194],{"class":157},[144,5967,5968],{"class":173},"55",[144,5970,194],{"class":157},[144,5972,5946],{"class":173},[144,5974,5909],{"class":157},[144,5976,5977,5980,5982,5985,5987,5990,5992,5995],{"class":146,"line":269},[144,5978,5979],{"class":173}," 174",[144,5981,194],{"class":157},[144,5983,5984],{"class":173},"11",[144,5986,194],{"class":157},[144,5988,5989],{"class":173},"21",[144,5991,194],{"class":157},[144,5993,5994],{"class":173},"112",[144,5996,5909],{"class":157},[144,5998,5999,6002,6004,6006,6008,6011,6013,6016],{"class":146,"line":283},[144,6000,6001],{"class":173}," 250",[144,6003,194],{"class":157},[144,6005,5924],{"class":173},[144,6007,194],{"class":157},[144,6009,6010],{"class":173},"27",[144,6012,194],{"class":157},[144,6014,6015],{"class":173},"136",[144,6017,5909],{"class":157},[144,6019,6020,6023,6025,6028,6030,6033,6035,6038],{"class":146,"line":300},[144,6021,6022],{"class":173}," 129",[144,6024,194],{"class":157},[144,6026,6027],{"class":173},"218",[144,6029,194],{"class":157},[144,6031,6032],{"class":173},"111",[144,6034,194],{"class":157},[144,6036,6037],{"class":173},"100",[144,6039,5909],{"class":157},[144,6041,6042,6045,6047,6050,6052,6054,6056],{"class":146,"line":311},[144,6043,6044],{"class":173}," 38",[144,6046,194],{"class":157},[144,6048,6049],{"class":173},"121",[144,6051,194],{"class":157},[144,6053,5984],{"class":173},[144,6055,194],{"class":157},[144,6057,6058],{"class":173},"3\n",[144,6060,6061],{"class":146,"line":717},[144,6062,5675],{"class":157},[144,6064,6065,6068,6070,6072,6075,6077,6080,6082,6084,6086,6088,6090,6092,6094,6096,6098,6100,6102,6104,6106,6108],{"class":146,"line":730},[144,6066,6067],{"class":157},"chacha_nonce ",[144,6069,1776],{"class":150},[144,6071,5883],{"class":173},[144,6073,6074],{"class":157},"([",[144,6076,3164],{"class":150},[144,6078,6079],{"class":173},"d0",[144,6081,194],{"class":157},[144,6083,5446],{"class":173},[144,6085,194],{"class":157},[144,6087,5446],{"class":173},[144,6089,194],{"class":157},[144,6091,5446],{"class":173},[144,6093,194],{"class":157},[144,6095,5446],{"class":173},[144,6097,194],{"class":157},[144,6099,5446],{"class":173},[144,6101,194],{"class":157},[144,6103,5446],{"class":173},[144,6105,194],{"class":157},[144,6107,5446],{"class":173},[144,6109,5675],{"class":157},[144,6111,6112],{"class":146,"line":746},[144,6113,240],{"emptyLinePlaceholder":239},[144,6115,6116,6118,6120],{"class":146,"line":768},[144,6117,3363],{"class":150},[144,6119,3419],{"class":575},[144,6121,3422],{"class":157},[144,6123,6124,6126,6128,6130,6132,6134],{"class":146,"line":790},[144,6125,1807],{"class":150},[144,6127,3429],{"class":173},[144,6129,3432],{"class":157},[144,6131,2611],{"class":150},[144,6133,3437],{"class":173},[144,6135,3440],{"class":157},[144,6137,6138,6140,6142],{"class":146,"line":812},[144,6139,3445],{"class":157},[144,6141,1782],{"class":173},[144,6143,1894],{"class":157},[144,6145,6146],{"class":146,"line":833},[144,6147,240],{"emptyLinePlaceholder":239},[144,6149,6150,6152,6154,6156,6158],{"class":146,"line":854},[144,6151,3458],{"class":157},[144,6153,1776],{"class":150},[144,6155,3463],{"class":157},[144,6157,1782],{"class":173},[144,6159,3358],{"class":157},[144,6161,6162],{"class":146,"line":876},[144,6163,240],{"emptyLinePlaceholder":239},[144,6165,6166,6168],{"class":146,"line":898},[144,6167,3476],{"class":150},[144,6169,3440],{"class":157},[144,6171,6172,6174,6176],{"class":146,"line":920},[144,6173,3483],{"class":157},[144,6175,1776],{"class":150},[144,6177,3488],{"class":157},[144,6179,6180,6182,6184,6186],{"class":146,"line":942},[144,6181,3493],{"class":150},[144,6183,3496],{"class":173},[144,6185,3499],{"class":150},[144,6187,3502],{"class":157},[144,6189,6190,6192,6194],{"class":146,"line":964},[144,6191,3445],{"class":157},[144,6193,1782],{"class":173},[144,6195,1894],{"class":157},[144,6197,6198],{"class":146,"line":975},[144,6199,240],{"emptyLinePlaceholder":239},[144,6201,6202,6204,6206],{"class":146,"line":992},[144,6203,3519],{"class":157},[144,6205,1776],{"class":150},[144,6207,3524],{"class":173},[144,6209,6210,6212,6214,6216],{"class":146,"line":1011},[144,6211,3529],{"class":150},[144,6213,3532],{"class":157},[144,6215,3535],{"class":150},[144,6217,3538],{"class":157},[144,6219,6220,6222,6224,6226,6228],{"class":146,"line":1030},[144,6221,1831],{"class":150},[144,6223,3545],{"class":150},[144,6225,3548],{"class":2585},[144,6227,3551],{"class":150},[144,6229,3554],{"class":157},[144,6231,6232,6234,6236],{"class":146,"line":1049},[144,6233,3559],{"class":157},[144,6235,1776],{"class":150},[144,6237,3564],{"class":157},[144,6239,6240],{"class":146,"line":1068},[144,6241,3569],{"class":150},[144,6243,6244],{"class":146,"line":1087},[144,6245,240],{"emptyLinePlaceholder":239},[144,6247,6248,6250,6252,6254,6256],{"class":146,"line":1111},[144,6249,1807],{"class":150},[144,6251,3580],{"class":157},[144,6253,3583],{"class":150},[144,6255,3586],{"class":173},[144,6257,3440],{"class":157},[144,6259,6260,6262,6264],{"class":146,"line":1133},[144,6261,3445],{"class":157},[144,6263,3595],{"class":173},[144,6265,1894],{"class":157},[144,6267,6268],{"class":146,"line":1141},[144,6269,240],{"emptyLinePlaceholder":239},[144,6271,6272,6274,6276,6278],{"class":146,"line":1161},[144,6273,3606],{"class":157},[144,6275,1776],{"class":150},[144,6277,3611],{"class":173},[144,6279,3614],{"class":157},[144,6281,6282,6284,6286,6288,6290,6292],{"class":146,"line":1177},[144,6283,3619],{"class":157},[144,6285,1776],{"class":150},[144,6287,3624],{"class":157},[144,6289,3627],{"class":150},[144,6291,1791],{"class":150},[144,6293,3632],{"class":173},[144,6295,6296],{"class":146,"line":1196},[144,6297,1802],{"class":157},[144,6299,6300],{"class":146,"line":1215},[144,6301,1802],{"class":157},[144,6303,6304,6306,6308,6310,6312],{"class":146,"line":1234},[144,6305,3529],{"class":150},[144,6307,3643],{"class":157},[144,6309,3535],{"class":150},[144,6311,3648],{"class":173},[144,6313,3651],{"class":157},[144,6315,6316,6318,6320,6322,6324,6326],{"class":146,"line":1253},[144,6317,3656],{"class":157},[144,6319,1776],{"class":150},[144,6321,3643],{"class":157},[144,6323,2238],{"class":150},[144,6325,1791],{"class":150},[144,6327,3632],{"class":173},[144,6329,6330,6333,6335,6338,6341,6343,6346,6349,6351,6354],{"class":146,"line":1272},[144,6331,6332],{"class":157}," cipher ",[144,6334,1776],{"class":150},[144,6336,6337],{"class":157}," ChaCha20.new(",[144,6339,6340],{"class":2142},"key",[144,6342,1776],{"class":150},[144,6344,6345],{"class":157},"chacha_key, ",[144,6347,6348],{"class":2142},"nonce",[144,6350,1776],{"class":150},[144,6352,6353],{"class":157},"chacha_nonce) ",[144,6355,6356],{"class":1866},"# fancy way to use ChaCha20 since nonce doesn't change\n",[144,6358,6359,6362,6364,6366,6368,6370,6372,6374,6377,6379,6381,6383],{"class":146,"line":1284},[144,6360,6361],{"class":157}," data[offset:offset ",[144,6363,434],{"class":150},[144,6365,1791],{"class":150},[144,6367,2743],{"class":173},[144,6369,1785],{"class":157},[144,6371,1776],{"class":150},[144,6373,3611],{"class":173},[144,6375,6376],{"class":157},"(cipher.decrypt(data[offset:offset ",[144,6378,434],{"class":150},[144,6380,1791],{"class":150},[144,6382,2743],{"class":173},[144,6384,6385],{"class":157},"]))\n",[144,6387,6388],{"class":146,"line":1302},[144,6389,1802],{"class":157},[144,6391,6392],{"class":146,"line":1324},[144,6393,240],{"emptyLinePlaceholder":239},[144,6395,6396,6398,6400],{"class":146,"line":1347},[144,6397,3738],{"class":157},[144,6399,3741],{"class":173},[144,6401,3744],{"class":157},[144,6403,6404,6406,6409],{"class":146,"line":1370},[144,6405,3749],{"class":157},[144,6407,6408],{"class":2585},"'molly_revenge_dec.exe'",[144,6410,1894],{"class":157},[144,6412,6413],{"class":146,"line":1392},[144,6414,1802],{"class":157},[144,6416,6417,6419,6421,6423,6425],{"class":146,"line":1415},[144,6418,1734],{"class":150},[144,6420,3765],{"class":173},[144,6422,3768],{"class":150},[144,6424,3771],{"class":2585},[144,6426,3440],{"class":157},[144,6428,6429],{"class":146,"line":1438},[144,6430,3778],{"class":157},[6432,6433],"hr",{},[10,6435,6437],{"id":6436},"special-notes","Special Notes",[15,6439,6440,6441],{},"Molly reimplements the Byfron Hyperion anti-tamper feature, originally adopted in Roblox, in a simpler CTF-style manner. ",[6442,6443,6444],"em",{},"This explains the fancy descriptions.",[50,6446,6449],{"className":6447,"code":6448,"language":55},[53],"[Roblox] Developers,\n\nWe know how important anti-cheat and security are for you and the entire Roblox community. At RDC 1,7k, we announced that we’re turning our focus to cheat prevention. To help get us there, we’re thrilled to welcome Byfron, a leader in anti-cheat solutions, to Roblox. Together, we are combining forces to greatly expand Roblox’s anti-cheat capabilities.\n\nByfron has developed a state-of-the-art anti-cheat solution that is being utilized by some of the world’s largest game publishers. The team is also passionate about competitive gaming and security, so we think they’re going to be a great match for our community. With their deep domain knowledge and security engineering expertise, we will be accelerating our roadmap to build robust anti-cheat and security solutions. This includes client-side and server-side anti-cheat, alt accounts detection, and additional tools for developers to combat cheaters. Integrating Byfron’s technology into the Roblox platform will improve experience security, protect the competitive landscape, and to allow developers to spend more time building their experiences.\n\nWe look forward to sharing more in the coming months. In the meantime, please join us in welcoming Byfron to the Roblox community!\n",[19,6450,6448],{"__ignoreMap":58},[6452,6453,6454],"style",{},"html pre.shiki code .suJrU, html code.shiki .suJrU{--shiki-default:#FF7B72}html pre.shiki code .sZEs4, html code.shiki .sZEs4{--shiki-default:#E6EDF3}html pre.shiki code .sFSAA, html code.shiki .sFSAA{--shiki-default:#79C0FF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sc3cj, html code.shiki .sc3cj{--shiki-default:#D2A8FF}html pre.shiki code .sH3jZ, html code.shiki .sH3jZ{--shiki-default:#8B949E}html pre.shiki code .sQhOw, html code.shiki .sQhOw{--shiki-default:#FFA657}html pre.shiki code .s9uIt, html code.shiki .s9uIt{--shiki-default:#A5D6FF}",{"title":58,"searchDepth":167,"depth":167,"links":6456},[6457,6458,6459,6460,6461,6462,6463,6464,6465],{"id":12,"depth":167,"text":13},{"id":81,"depth":167,"text":82},{"id":113,"depth":167,"text":114},{"id":2115,"depth":167,"text":2116},{"id":3781,"depth":167,"text":3782},{"id":3823,"depth":167,"text":3824},{"id":5831,"depth":167,"text":5832},{"id":5838,"depth":167,"text":5839},{"id":6436,"depth":167,"text":6437},"2025-02-01","Deep dive into two of my CTF challenges focusing on reverse engineering and anti-tamper mechanisms","md",null,{"readingTime":730},"\u002Fb\u002Fmolly",{"title":5,"description":6467},{"loc":6471},"b\u002Fmolly",[6476,6477,6478,6479,6480],"reverse-engineering","ctf","winapi","anti-tamper","instrumentational-callback","X6L6V3bdC0iVGCorAMkDqZO3H1QlpVSsoPI4icJoEGE",1786184836295]