Groups > alt.comp.hardware.pc-homebuilt > #40081

Re: Kaspersky Rescue Disk Report - can't see full paths

From	"Apd" <not@all.invalid>
Newsgroups	alt.comp.hardware.pc-homebuilt, alt.comp.anti-virus, alt.computer.security
Subject	Re: Kaspersky Rescue Disk Report - can't see full paths
Date	2019-06-06 10:48 +0100
Organization	Aioe.org NNTP Server
Message-ID	<qdankh$11kc$2@gioia.aioe.org> (permalink)
References	<nejffe97aurtm817oikhrshavi00cfgkuo@4ax.com> <qd9c1h$lh$1@dont-email.me> <qd9mah$iig$1@gioia.aioe.org> <qdab1r$3g9$1@dont-email.me>

Cross-posted to 3 groups.

Show all headers | View raw

"Paul" wrote:
> Apd wrote:
>> "Paul" wrote:
>>> This smells funny...
>>>
>>>     CF CF CF CF CF CF CF CF CF CF CF CF
>>
>> It smells like spaces!
>>
>> XOR the base64 with 0xEF and you have plain text with a single
>> linefeed terminating each line. It's an XML report. Here's a line from
>> your second example, krdeicar.txt (wrapped for ease of reading):
>>
>> <Event1 Action="Detect" Time="132042218823887019"
>>  Object="@Filesystem[65ba0377-31a7-52e4-8e5b-5415b3a73f12]/Downloads/EICARAntiVirusTestFile.com"
>>  Info="EICAR-Test-File" />
>
> Yup. Even when the problem switched from "encryption"
> to "encoding", I still couldn't see it. And I've had
> trouble spotting XOR() related patterns before too.
> It's a disease.

Often when you see the high bit set in every byte in data which has a
pattern is a clue that there is XOR present. A simple guess as to what
might be a character sequence, like the spaces in this example, gives
you the key.

> I tried to implement the function in gawk, but the conversion
> from substr() to number insisted on doing the wrong thing when the
> msb of a character is set. So I had to punt and use C instead.
> For which, somebody already wrote our program for us. Just change
> the XORBYTE constant, and it's ready to compile.

My own code is much the same but I also pass the XOR constant as
a command line argument. I pass it as a variable (even) length hex
string since sometimes more than one byte is used in the key. The code
is a little more involved in checking for valid hex, etc.

Back to alt.comp.hardware.pc-homebuilt | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Kaspersky Rescue Disk Report - can't see full paths Shadow <Sh@dow.br> - 2019-06-05 12:21 -0300
  Re: Kaspersky Rescue Disk Report - can't see full paths Paul <nospam@needed.invalid> - 2019-06-05 17:26 -0400
    Re: Kaspersky Rescue Disk Report - can't see full paths Shadow <Sh@dow.br> - 2019-06-05 20:28 -0300
    Re: Kaspersky Rescue Disk Report - can't see full paths "Apd" <not@all.invalid> - 2019-06-06 01:19 +0100
      Re: Kaspersky Rescue Disk Report - can't see full paths Shadow <Sh@dow.br> - 2019-06-06 00:06 -0300
        Re: Kaspersky Rescue Disk Report - can't see full paths "Apd" <not@all.invalid> - 2019-06-06 10:46 +0100
          Re: Kaspersky Rescue Disk Report - can't see full paths "wasbit" <wasbitREMOVE@hotmail.com> - 2019-06-07 09:53 +0100
            Re: Kaspersky Rescue Disk Report - can't see full paths "Apd" <not@all.invalid> - 2019-06-07 10:43 +0100
            Re: Kaspersky Rescue Disk Report - can't see full paths Shadow <Sh@dow.br> - 2019-06-08 16:13 -0300
        Re: Kaspersky Rescue Disk Report - can't see full paths "David B." <BDonTJ@REMOVE.gmail.com> - 2019-06-07 08:11 +0100
      Re: Kaspersky Rescue Disk Report - can't see full paths Paul <nospam@needed.invalid> - 2019-06-06 02:15 -0400
        Re: Kaspersky Rescue Disk Report - can't see full paths "Apd" <not@all.invalid> - 2019-06-06 10:48 +0100

csiph-web