forked from nazywam/AutoIt-Ripper
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathopcodes.py
88 lines (80 loc) · 1.99 KB
/
opcodes.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
from struct import unpack_from
from typing import Tuple
def blob(data: bytes) -> Tuple[str, int]:
off = 0
var = data[off]
out = ""
if var == 0x33:
out = "$"
elif var == 0x36:
out = "\""
elif var == 0x30:
pass
elif var == 0x32:
out = "@"
elif var == 0x34:
pass
elif var == 0x35:
pass
off += 1
key = unpack_from("<H", data[off:])[0]
off += 2 + 2
dec = [0] * (key * 2)
for i in range(key):
d = unpack_from("<H", data[off:])[0]
d ^= key
dec[i * 2 + 0] = d & 0xff
dec[i * 2 + 1] = (d >> 8) & 0xff
off += 2
out += bytes(dec).decode('utf-16')
if var == 0x36:
out += "\" "
elif var == 0x33 and data[off] == 0x35:
out += "."
else:
out += " "
return (out, off)
OPCODES = {
0x05: lambda x: (str(unpack_from("<I", x)[0]) + " ", 1 + 4),
0x10: lambda x: (str(unpack_from("<Q", x)[0]) + " ", 1 + 8),
0x20: lambda x: (str(unpack_from("<d", x)[0]) + " ", 1 + 8),
0x30: blob,
0x31: blob,
0x32: blob,
0x33: blob,
0x34: blob,
0x35: blob,
0x36: blob,
0x37: blob,
0x38: blob,
0x39: blob,
0x3a: blob,
0x3b: blob,
0x3c: blob,
0x3d: blob,
0x3e: blob,
0x3f: blob,
0x40: lambda x: (", ", 1),
0x41: lambda x: ("= ", 1),
0x42: lambda x: ("> ", 1),
0x43: lambda x: ("< ", 1),
0x44: lambda x: ("<> ", 1),
0x45: lambda x: (">= ", 1),
0x46: lambda x: ("<= ", 1),
0x47: lambda x: ("( ", 1),
0x48: lambda x: (") ", 1),
0x49: lambda x: ("+ ", 1),
0x4a: lambda x: ("- ", 1),
0x4b: lambda x: ("/ ", 1),
0x4c: lambda x: ("* ", 1),
0x4d: lambda x: ("& ", 1),
0x4e: lambda x: ("[ ", 1),
0x4f: lambda x: ("] ", 1),
0x50: lambda x: ("== ", 1),
0x51: lambda x: ("^ ", 1),
0x52: lambda x: ("+= ", 1),
0x53: lambda x: ("-= ", 1),
0x54: lambda x: ("/= ", 1),
0x55: lambda x: ("*= ", 1),
0x56: lambda x: ("&= ", 1)
}