Bugfixes

Author: meck-gd

analyze_crypted_code.py

@@ -106,12 +106,13 @@ def process_code_object(code_obj, filedata: bytes, crypted_regions: list[dict])
         filedata: Entire contents of the Python module
         crypted_regions: List that is appended to
     """
+    if info := get_crypto_info(filedata, code_obj):
+        crypted_regions.append(info)
+
     for const in code_obj.co_consts:
         if isinstance(const, type((lambda: None).__code__)):
             print("Found nested code object: " + str(const))
             display_code(const)
-            if info := get_crypto_info(filedata, const):
-                crypted_regions.append(info)
 
             process_code_object(const, filedata, crypted_regions)
 
@@ -127,7 +128,6 @@ def main(filename: str) -> None:
 
     crypted_regions: list[dict] = []
     process_code_object(obj, data, crypted_regions)
-    crypted_regions.append(get_crypto_info(data, obj))
 
     json.dump(crypted_regions, open(filename + ".json", "w"))
 

decrypt_gcm.py

@@ -113,7 +113,8 @@ def decrypt_gcm_without_tag(key: bytes, nonce: bytes, ciphertext: bytes) -> byte
     crypted_regions = json.load(open(filename + ".json"))
 
     for region in crypted_regions:
-        start = region["ciphertext_offset"] + 0x20  # account for pyarmor module header
+        skip = int.from_bytes(module[0:4], 'little') + int.from_bytes(module[4:8], 'little')
+        start = region["ciphertext_offset"] + skip
         size = region["ciphertext_size"]
         ciphertext = module[start:start+size]
         nonce = bytes.fromhex(region["nonce"])