0

Below is a part of a code that I reversed with repy2exe and I want to understand what it does and especially how to decode the value in the "secret" variable:

using = [
    'Mg==\n',
    'MTA1\n',
    'Nzg=\n',
    'ODI=\n',
    'NzM=\n',
    'Njg=\n',
    'Nzk=\n',
    'OTg=\n',
    'ODg=\n',
    'Njc=\n',
    'Njg=\n',
    'ODM=\n',
    'MTk=\n',
    'MTc=\n',
    'MTY=\n',
    'MjI=\n']
secret = 'BZh91AY&SY\xf2\xbfIg\x00\x00\x01\x89\x80\x05\x002\x00\x08\x00 \x00!\x80\x0c\x01[6\xe2\xeeH\xa7\n\x12\x1eW\xe9,\xe0'
pas = raw_input('Please Enter The Password:')
a = ''
for i in range(len(pas)):
    a += pas[i]

coun = 0
win = 16
|improve this question

closed as unclear what you're asking by NirIzr, perror, 0xec, Vitaly Osipov, peter ferrie Aug 18 '17 at 20:24

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

1

Although the code is clearly incomplete, some things can be guessed:

1) The strings ending with == are most likely base64-encoded (Base64 uses = for padding). Let's try to decode them.

>>>x = [a.decode('base64') for a in using]
'2', '105', '78', '82', '73', '68', '79', '98', '88', '67', '68', '83', '19', '17', '16', '22']

So they decode to string representations of some numbers. Not sure if this means anything, we need to see how they're used.

2) The BZ sequence hints at Bzip2. We can try to decompress it as such:

>>> import bz2
>>> bz2.decompress(secret)
'base64'

And we're back to square one.

|improve this answer
  • Yes you right, the code isn't complete. Can you explain me where you noticed that this code is using a BZ? – caliber Aug 5 '17 at 19:40
  • You can see that the variable "secret" begins with "BZ" which is the magic number of the Bzip2 file format: en.wikipedia.org/wiki/Bzip2#File_format – Megabeets Aug 5 '17 at 20:03
  • Oh now I understand. So the decompress code that you used here gives the value of 'base64', does it mean the value is 'base64' or the type of the value that was decompressed with the code above is base64? – caliber Aug 5 '17 at 20:17
  • the secret decompresses to literal string "base64". Since we don't have rest of code, I have no idea how it's used. – Igor Skochinsky♦ Aug 5 '17 at 20:19
  • Yeah I understand what you are saying. The strange thing about the EXE program that I don't understand is when I using debugger like Olly or Immunity it does not show the strings that the program is using like: "please enter the password" or "wrong password". I thing that is somehow encrypted so the strings cannot be seen, and this is what give me a hard time to RE this program. Can you suggest how to decrypt the content of the program? – caliber Aug 5 '17 at 20:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.