# Path: malwareconfig/crypto.py
# def decrypt_rsa(key, data):
# def decrypt_xor(key, data):
# def decrypt_arc4(key, data):
# def decrypt_des_ecb(key, data, iv=None):
# def decrypt_des_cbc(key, data, iv=None):
# def decrypt_des3(key, data):
# def decrypt_aes(key, data):
# def decrypt_aes_cbc_iv(key, iv, data):
# def decrypt_blowfish(key, data):
# def decrypt_RC6(key, encrypted, P, Q, rounds):
#     def rol(a, i):
#     def ror(a, i):
#     def to_int(bytestring):
#     def decrypt_block(block, S):
# def derive_pbkdf2(key, salt, iv_length, key_length, iterations=8):
#     T = 2 * rounds + 4
#     L = to_int(key)
#     S = []
#     S = [0 for i in range(T)]
#     S[0] = P
#     A = 0
#     B = 0
#         A = S[i] = rol((S[i] + A + B), 3)
#         B = L[j] = rol((L[j] + A + B), (A + B))
# 
# Path: malwareconfig/common.py
# class Decoder(object):
#     decoder_name = ""
#     decoder_version = 1
#     decoder_author = ""
#     decoder_description = ""
#     file_info = object
# 
#     def set_file(self, file_info):
#         self.file_info = file_info
# 
#     def get_config(self):
#         pass
# 
# Path: malwareconfig/common.py
# def string_printable(line):
#     line = str(line)
#     new_line = ''
#     for c in line:
#         if c in string.printable:
#             new_line += c
#         else:
#             new_line += '\\x' + c.encode("utf-8").hex()
#     return new_line


from malwareconfig import crypto
from malwareconfig.common import Decoder
from malwareconfig.common import string_printable
from binascii import hexlify, unhexlify
from struct import unpack
import re
import zlib
import uuid
        # Get Resource
        res_data = False
        if b'Data.bin' in dotnet_res_names:
            res_data = self.file_info.dotnet_resource_by_name(b'Data.bin')
        elif len(pe_res_names) == 1:
            res_data = self.file_info.pe_resource_id(pe_res_names[0])
        else:
            res_data = self.file_info.pe_resource_id(1)


        # Return no resource
        if not res_data:
            print("  [-] No Config Resource Found")
            return # Check what we do for a negative result


        # What Version are we on

        if res_data[0:4] == b'\x08\x00\x00\x00':
            conf_dict = self.decrypt_v2(res_data)
            
        elif res_data[0:4] == b'\x10\x00\x00\x00':
            # we need to derive a key from teh assembly guid
            guid = self.file_info.dotnet_guids()[1]
            #guid = re.search(b'[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}', file_data).group()
            #print(guid)
            guid = uuid.UUID(guid).bytes_le
            encrypted_key = res_data[4:20]
            # rfc2898 derive bytes
            #derived_key = derive_key(guid, encrypted_key)

# Path: malwareconfig/crypto.py
# def decrypt_rsa(key, data):
# def decrypt_xor(key, data):
# def decrypt_arc4(key, data):
# def decrypt_des_ecb(key, data, iv=None):
# def decrypt_des_cbc(key, data, iv=None):
# def decrypt_des3(key, data):
# def decrypt_aes(key, data):
# def decrypt_aes_cbc_iv(key, iv, data):
# def decrypt_blowfish(key, data):
# def decrypt_RC6(key, encrypted, P, Q, rounds):
#     def rol(a, i):
#     def ror(a, i):
#     def to_int(bytestring):
#     def decrypt_block(block, S):
# def derive_pbkdf2(key, salt, iv_length, key_length, iterations=8):
#     T = 2 * rounds + 4
#     L = to_int(key)
#     S = []
#     S = [0 for i in range(T)]
#     S[0] = P
#     A = 0
#     B = 0
#         A = S[i] = rol((S[i] + A + B), 3)
#         B = L[j] = rol((L[j] + A + B), (A + B))
# 
# Path: malwareconfig/common.py
# class Decoder(object):
#     decoder_name = ""
#     decoder_version = 1
#     decoder_author = ""
#     decoder_description = ""
#     file_info = object
# 
#     def set_file(self, file_info):
#         self.file_info = file_info
# 
#     def get_config(self):
#         pass
# 
# Path: malwareconfig/common.py
# def string_printable(line):
#     line = str(line)
#     new_line = ''
#     for c in line:
#         if c in string.printable:
#             new_line += c
#         else:
#             new_line += '\\x' + c.encode("utf-8").hex()
#     return new_line


# Path: malwareconfig/decoders/nanocore.py
from malwareconfig import crypto
from malwareconfig.common import Decoder
from malwareconfig.common import string_printable
from binascii import hexlify, unhexlify
from struct import unpack
import re
import zlib
import uuid

        # Get Resource
        res_data = False
        if b'Data.bin' in dotnet_res_names:
            res_data = self.file_info.dotnet_resource_by_name(b'Data.bin')
        elif len(pe_res_names) == 1:
            res_data = self.file_info.pe_resource_id(pe_res_names[0])
        else:
            res_data = self.file_info.pe_resource_id(1)


        # Return no resource
        if not res_data:
            print("  [-] No Config Resource Found")
            return # Check what we do for a negative result


        # What Version are we on

        if res_data[0:4] == b'\x08\x00\x00\x00':
            conf_dict = self.decrypt_v2(res_data)
            
        elif res_data[0:4] == b'\x10\x00\x00\x00':
            # we need to derive a key from teh assembly guid
            guid = self.file_info.dotnet_guids()[1]
            #guid = re.search(b'[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}', file_data).group()
            #print(guid)
            guid = uuid.UUID(guid).bytes_le
            encrypted_key = res_data[4:20]
            # rfc2898 derive bytes
            #derived_key = derive_key(guid, encrypted_key)

            div, dkey = crypto.derive_pbkdf2(guid, guid, 16, 16, iterations=8)