ptn1411/skill/nuitka-decryptor

Source .py  →  encrypt(XOR + Base64, key)  →  .encrypted files
              key embedded in Nuitka constants (.rdata / .rsrc section of .pyd)

target_app/
├── app/
│   ├── encrypted_sources/
│   │   ├── MANIFEST.txt        ← list of all source files
│   │   └── *.encrypted         ← encrypted Python source
│   └── repo/updater/
│       ├── config_loader.pyd   ← KEY IS HERE (Nuitka constants)
│       └── update_agent.pyd    ← secondary binary
├── *.encrypted                 ← encrypted config files
└── decrypted_sources/          ← output directory

python scripts/analyze_binary.py \
  --pyd path/to/config_loader.pyd \
  --out binary_analysis.txt

BT_DEV_2025_SECURE    ← 18-char ASCII key
BT_Automation_Tiktok  ← variant

python scripts/extract_key.py \
  --pyd path/to/config_loader.pyd \
  --config path/to/update_config.json.encrypted \
  --out key_extraction.txt

key[0] = config_enc[0] ^ ord('{')   # JSON always starts with {
key[1] = config_enc[1] ^ ord('\n')  # formatted JSON has newline
key[2] = config_enc[2] ^ ord(' ')   # indented with spaces
# Continue to recover full key byte-by-byte

# Decrypt all files listed in MANIFEST.txt
python scripts/decrypt_all.py \
  --key "BT_DEV_2025_SECURE" \
  --encrypted-dir path/to/app/encrypted_sources \
  --output-dir path/to/decrypted_sources \
  --manifest path/to/app/encrypted_sources/MANIFEST.txt
 
# Decrypt a single .encrypted file
python scripts/decrypt_all.py \
  --key "BT_DEV_2025_SECURE" \
  --single path/to/file.encrypted \
  --output-dir ./out
 
# Decrypt a config file
python scripts/decrypt_all.py \
  --key "BT_DEV_2025_SECURE" \
  --single update_config.json.encrypted \
  --output-dir ./out

import base64
def xor_decrypt(payload_b64: str, key: bytes) -> str:
    decoded = base64.b64decode(payload_b64)
    kr = (key * (len(decoded) // len(key) + 1))[:len(decoded)]
    return bytes(a ^ b for a, b in zip(decoded, kr)).decode('utf-8')

# Check a sample file looks like valid Python
head -50 decrypted_sources/main.py
head -50 decrypted_sources/core/config.py
 
# Search for hardcoded secrets in decrypted source
grep -rn "api_key\|secret\|password\|token\|LICENSE" decrypted_sources/
grep -rn "http\|https" decrypted_sources/ | grep -v "\.pyc"

python scripts/extract_keygen_data.py \
  --pyd path/to/main_app.pyd \
  --out keygen_info.txt

# Quick sanity check
result = xor_decrypt(open('update_config.json.encrypted').read().strip(), key)
assert result.strip().startswith('{'), f"Wrong key! Got: {result[:20]}"
import json; json.loads(result)  # must parse as valid JSON
print("Key confirmed:", key)

1. RECON    → Identify .pyd files, .encrypted files, MANIFEST.txt
2. ANALYZE  → Run analyze_binary.py → find key candidates
3. EXTRACT  → Run extract_key.py → confirm key via known-plaintext
4. DECRYPT  → Run decrypt_all.py → bulk decrypt all source files
5. KEYGEN   → Run extract_keygen_data.py → extract HWID/hash data for keygen
6. VERIFY   → Sample check + grep for secrets/hardcoded values
7. REPORT   → Present findings to user IN VIETNAMESE

✅ Giải mã hoàn tất:
 
  🔑 Key tìm được  : <KEY_VALUE>
  📦 Thuật toán    : XOR + Base64
  📁 File giải mã  : N / TOTAL file thành công
  💾 Output        : decrypted_sources/
 
  🔍 Phát hiện đáng chú ý:
    - <danh sách secrets, endpoints, license logic>
    - <Thông tin Keygen: HWID pattern, hash constants, secret salts>
 
▶  Bước tiếp theo:
   grep -rn "api_key\|secret" decrypted_sources/