莫克莱特庄园之谜的解开xor加密后的样本

shane007

rt,据说用了lzma压缩，待研究。
2 d& \7 c/ G" ~$ Z% `

shane007

9 T2 T7 }2 g2 a" J! Y& E
! B. A+ I) \) Y3 v6 v; V, e! gF4 00 00 00 00 00 00 00 9A 00 00 00 00 00 00 00 11 C2 18 00 00 00 00 00 01 00 25
5D 00 00 00 00 00 00 00 54 00 00 00 00 00 00 00 AB C2 18 00 00 00 00 00 01 00 2C
2C 01 00 00 00 00 00 00 FB 00 00 00 00 00 00 00 FF C2 18 00 00 00 00 00 01 00 2F
# R4 b) q, h5 p  h24 01 00 00 00 00 00 00 F3 00 00 00 00 00 00 00 FA C3 18 00 00 00 00 00 01 00 2A
9 }* L( B/ w% c( ^4 y3 l80 03 00 00 00 00 00 00 52 00 00 00 00 00 00 00 ED C4 18 00 00 00 00 00 01 00 39
5 ~6 q6 [0 [: E% G6B 00 00 00 00 00 00 00 65 00 00 00 00 00 00 00 3F C5 18 00 00 00 00 00 01 00 2F
$ N* q; J% ~. }$ c8 N: m% W
5 R2 R7 A/ t! ?* K0 L  e初步分析，文件结构如下
4 X& w5 M5 v$ MfilenameLength 2bytes
  o! s4 B7 v: f% Cfilename       nbytes
8 m8 Q7 f' S! \7 C: g0 Psize   8bytes
* |: y' t1 ?' n2 L3 Ezsize  8bytes
offset 8bytes
. U, P$ U, j/ g$ qflag   1bytes  folder:1  file:0