INNER CODE UNIT · Python

decode_payload

gendigitalinc/ioc · Manjusaka/rip.py:23

def decode_payload(buff):
    payload_type = 'ELF'
    decoded = inflate(raw_hex(buff))
    if decoded.startswith(b'MZ'):
        payload_type = 'EXE'
    o_name = 'payload_' + payload_type + '_decoded.bin'
    o = open(o_name,'wb')
    o.write(decoded)
    o.close()
    print(o_name+ ' saved.')


def main():
    if len(sys.argv) < 2:
        print('usage: rip.py path_to_framework_file')
        sys.exit()
    try:
        f = open(sys.argv[1],'rb')

View source record →