import sys from capstone import * from capstone.x86 import * with open(sys.argv[1]) as f: bytes = f.read() FD = open(sys.argv[1]+'.clean','w') def disasm(xxx): md = Cs(CS_ARCH_X86, CS_MODE_64) by = md.disasm(xxx,EA).next().bytes FD.write(by) return len(by) off = 0 EA = 0x400A22 while off < len(bytes): b=chr( (ord(bytes[off]) ^ EA)&0xff) x= disasm(b + bytes[off+1:off+1+20]) EA += x off += x FD.close()