def _read_java_obj(cls, data, pos, ignore_remaining_data=False):
data_stream = BytesIO(data[pos:])
obj = javaobj.load(data_stream,
ignore_remaining_data=ignore_remaining_data)
obj_size = data_stream.tell()
return obj, pos + obj_size
def DecryptMetadata(arg, options):
oOutput = InstantiateCOutput(options)
oOutput.Line('Input: %s' % arg)
arg = cCSInstructions(cCSInstructions.CS_INSTRUCTION_TYPE_METADATA,
options.transform).ProcessInstructions(arg.encode())
oOutput.Line('Encrypted metadata: %s' % binascii.b2a_hex(arg).decode())
if options.private != '':
decrypted = RSADecrypt(options.private, arg)
if decrypted != None:
DecodeMetadata(decrypted, oOutput)
elif options.file != '':
if javaobj == None:
print('javaobj module required: pip install javaobj-py3')
exit(-1)
pobj = javaobj.load(open(options.file, 'rb'))
privateKey = binascii.b2a_hex(
bytes([
number & 0xFF
for number in pobj.array.value.privateKey.encoded._data
])).decode()
decrypted = RSADecrypt(privateKey, arg)
if decrypted != None:
DecodeMetadata(decrypted, oOutput)
else:
jsonData = GetJSONData()
for publicKey, dPrivatekey in jsonData['dLookupValues']['7'].items():
privateKey = dPrivatekey['verbose']
decrypted = RSADecrypt(privateKey, arg)
if decrypted != None:
DecodeMetadata(decrypted, oOutput)
break
def get_java_object(obj_file):
with open(obj_file, 'rb') as fd:
obj = javaobj.load(fd)
return obj
def _read_java_obj(data, pos, ignore_remaining_data=False):
data_stream = BytesIO(data[pos:])
obj = javaobj.load(data_stream, ignore_remaining_data=ignore_remaining_data)
obj_size = data_stream.tell()
return obj, pos + obj_size
def _read_java_obj(data, pos):
data_stream = StringIO.StringIO(data[pos:])
obj = javaobj.load(data_stream)
obj_size = data_stream.tell()
return obj, pos + obj_size
def _read_java_obj(data, pos):
data_stream = StringIO.StringIO(data[pos:])
obj = javaobj.load(data_stream)
obj_size = data_stream.tell()
return obj, pos + obj_size