A couple years ago I published tool xorsearch.py for this diary entry: “Small Challenge: A Simple Word Maldoc – Part 4”.
It could be used to search for XOR-encoded text:
This was a beta version, and its user interface was subject to change. The version I released recently is a rewrite, and option -t no longer exists.
To achieve a similar result with the new version of xorsearch.py, one uses now option -P (Python) and provides a Python function that filters out printable text: IsPrintable
Option -D can then be used to dump the decoded data with an extra newline:
Here too XOR encoding with key 0x6f reveals the hidden command.
Didier Stevens
Senior handler
blog.DidierStevens.com
