莫克莱特庄园之谜的解开xor加密后的样本

shane007

rt,据说用了lzma压缩，待研究。
0 i3 O* B9 y8 ^* C% J# c7 d, ]' p! E

shane007

2 m: }5 e; l; h' o+ a8 V
/ B2 H0 [+ z( u4 i1 ?* i  mF4 00 00 00 00 00 00 00 9A 00 00 00 00 00 00 00 11 C2 18 00 00 00 00 00 01 00 25
5D 00 00 00 00 00 00 00 54 00 00 00 00 00 00 00 AB C2 18 00 00 00 00 00 01 00 2C
2C 01 00 00 00 00 00 00 FB 00 00 00 00 00 00 00 FF C2 18 00 00 00 00 00 01 00 2F
* w8 Y  ~* S0 q# h0 f* T. m24 01 00 00 00 00 00 00 F3 00 00 00 00 00 00 00 FA C3 18 00 00 00 00 00 01 00 2A
  Z0 G0 R* o+ B0 R# J7 b) j2 U6 D80 03 00 00 00 00 00 00 52 00 00 00 00 00 00 00 ED C4 18 00 00 00 00 00 01 00 39
" Z' G8 A2 W2 f& {4 }3 v6B 00 00 00 00 00 00 00 65 00 00 00 00 00 00 00 3F C5 18 00 00 00 00 00 01 00 2F

初步分析，文件结构如下
4 c/ F, ]! i* m+ G5 }8 ]; ofilenameLength 2bytes
filename       nbytes
size   8bytes
4 h/ {+ A3 z) azsize  8bytes
2 n! J8 ~  w; Doffset 8bytes
flag   1bytes  folder:1  file:0
& Z  \( q3 D. V. g5 C# |- J