XOR

• 排他的論理和(XOR)を使用した暗号

• xortools.py

• key: 0xBC

from xortools import single_byte_xor
in_buf = open('test.txt', 'rb').read()
out_buf = open('test-xor.txt', 'wb')
out_buf.write(single_byte_xor(in_buf, 0xBC))
out_buf.close()

• 指定したファイルを key 0-255 でXOR (256個のファイルを作成) ¹⁾

xor-single.py

#!/usr/bin/python
# -*- coding: UTF-8 -*-
 
import sys
from xortools import single_byte_xor
 
if len(sys.argv) == 1:
  print "usage: " + __file__ + " filename"
  sys.exit()
 
key = 0
argvs = sys.argv
 
in_buf = open(argvs[1], 'rb').read()
 
while key < 256:
        hkey = hex(key)
        output = str(argvs[1]) + '.' + str(hkey) + '.xor'
        out_buf = open(output, 'wb')
        out_buf.write(single_byte_xor(in_buf, key))
        out_buf.close()
        key += 1

• key: 0x12345678

from xortools import four_byte_xor
in_buf = open('test.txt', 'rb').read()
out_buf = open('test-xor.txt', 'wb')
out_buf.write(four_byte_xor(in_buf, 0x12345678))
out_buf.close()

• XORSearch « Didier Stevens
  • XOR keys (0 to 255)　※Single-byte XOR
  • ROL keys (1 to 7)
  • ROT keys (1 to 25)

# ./XORSearch.exe key.zip.enc key.txt                                                                                         
Found XOR AB position 001E: key.txt.A.
Found XOR AB position 0075: key.txtPK..
#

Usage: XORSearch [-siuh] [-l length] [-n length] [-f search-file] file string
XORSearch V1.6, search for a XOR, ROL or ROT encoded string in a file
Use -s to save the XOR, ROL or ROT encoded file containing the string
Use -l length to limit the number of printed characters (50 by default)
Use -i to ignore the case when searching
Use -u to search for Unicode strings (limited support)
Use -f to provide a file with search strings
Use -n length to print the length neighbouring charaters (before & after the found keyword)
Use -h to search for hex strings
Options -l and -n are mutually exclusive
Options -u and -h are mutually exclusive
Source code put in the public domain by Didier Stevens, no Copyright
Use at your own risk
https://DidierStevens.com

• New Tool: XORStrings « Didier Stevens

• Kahu Security - Exploring XOR Decryption Methods