diff --git a/.gitignore b/.gitignore index e69de29..44abc33 100644 --- a/.gitignore +++ b/.gitignore @@ -0,0 +1,3 @@ +/XORSearch_V1_11_1.zip +/XORSearch_V1_11_2.zip +/XORSearch_V1_11_4.zip diff --git a/sources b/sources index e69de29..a4e42c7 100644 --- a/sources +++ b/sources @@ -0,0 +1 @@ +SHA512 (XORSearch_V1_11_4.zip) = efb0b5e887381bee572228a92b90eac47b236df364dd29001a1783ecc0b305c3fe43e0de55a4891edde5d717abd0115c0f1d8306e706b8177cbe717ffe83d01d diff --git a/xorsearch-cosmetics.patch b/xorsearch-cosmetics.patch new file mode 100644 index 0000000..6a27251 --- /dev/null +++ b/xorsearch-cosmetics.patch @@ -0,0 +1,255 @@ +diff -ru xorsearch-1.11.4.orig/XORSearch.c xorsearch-1.11.4.new/XORSearch.c +--- xorsearch-1.11.4.orig/XORSearch.c 2020-07-15 22:16:48.000000000 +0200 ++++ xorsearch-1.11.4.new/XORSearch.c 2022-06-23 18:04:37.623125758 +0200 +@@ -102,9 +102,9 @@ + unsigned char ucMaskFixed; + unsigned char ucBitsFixed; + unsigned char ucMaskVariable1; +- char cVariableName1; ++ unsigned char ucVariableName1; + unsigned char ucMaskVariable2; +- char cVariableName2; ++ unsigned char ucVariableName2; + unsigned char ucJumpBytes; + } WILDCARD; + +@@ -239,9 +239,9 @@ + ucMask = ucMask >> 1; + ucValue = ucValue >> 1; + } +- if (aiVariables[(int)pSearch->pWildcards[iIter].cVariableName1] == -1) +- aiVariables[(int)pSearch->pWildcards[iIter].cVariableName1] = ucValue; +- else if (aiVariables[(int)pSearch->pWildcards[iIter].cVariableName1] != ucValue) ++ if (aiVariables[(int)pSearch->pWildcards[iIter].ucVariableName1] == -1) ++ aiVariables[(int)pSearch->pWildcards[iIter].ucVariableName1] = ucValue; ++ else if (aiVariables[(int)pSearch->pWildcards[iIter].ucVariableName1] != ucValue) + break; + } + if (pSearch->pWildcards[iIter].ucMaskVariable2 != 0) +@@ -253,9 +253,9 @@ + ucMask = ucMask >> 1; + ucValue = ucValue >> 1; + } +- if (aiVariables[(int)pSearch->pWildcards[iIter].cVariableName2] == -1) +- aiVariables[(int)pSearch->pWildcards[iIter].cVariableName2] = ucValue; +- else if (aiVariables[(int)pSearch->pWildcards[iIter].cVariableName2] != ucValue) ++ if (aiVariables[(int)pSearch->pWildcards[iIter].ucVariableName2] == -1) ++ aiVariables[(int)pSearch->pWildcards[iIter].ucVariableName2] = ucValue; ++ else if (aiVariables[(int)pSearch->pWildcards[iIter].ucVariableName2] != ucValue) + break; + } + iIter++; +@@ -327,6 +327,11 @@ + int iFound = 0; + int iIter; + ++ if ( pSearch == NULL ) ++ { ++ return iFound = 0; ++ } ++ + for (iIter = 0; pSearch[iIter].iSearchType != SEARCHTYPE_STOP; iIter++) + { + if (WildcardSearch(&pSearch[iIter], pucBuffer, lSize, sOperation, ucOffset, uiOperand, iMaxLength, piScore)) +@@ -1042,9 +1047,9 @@ + pWildcard->ucMaskFixed = 0; + pWildcard->ucBitsFixed = 0; + pWildcard->ucMaskVariable1 = 0; +- pWildcard->cVariableName1 = 0; ++ pWildcard->ucVariableName1 = 0; + pWildcard->ucMaskVariable2 = 0; +- pWildcard->cVariableName2 = 0; ++ pWildcard->ucVariableName2 = 0; + + for (iIter = 0; iIter < 8; iIter++) + { +@@ -1069,13 +1074,13 @@ + if (0 == iCountVariable) + { + pWildcard->ucMaskVariable1 |= 1 << (7 - iIter); +- pWildcard->cVariableName1 = szBits[iIter] - 'A'; ++ pWildcard->ucVariableName1 = szBits[iIter] - 'A'; + iCountVariable++; + } + else if (1 == iCountVariable) + { + pWildcard->ucMaskVariable2 |= 1 << (7 - iIter); +- pWildcard->cVariableName2 = szBits[iIter] - 'A'; ++ pWildcard->ucVariableName2 = szBits[iIter] - 'A'; + iCountVariable++; + } + else +@@ -1379,7 +1384,7 @@ + { + if (0 == iVariable1WasPrinted) + { +- printf("%c", pSearch[iIter1].pWildcards[iIter2].cVariableName1 + 'A'); ++ printf("%c", pSearch[iIter1].pWildcards[iIter2].ucVariableName1 + 'A'); + iVariable1WasPrinted = 1; + } + else +@@ -1389,7 +1394,7 @@ + { + if (0 == iVariable2WasPrinted) + { +- printf("%c", pSearch[iIter1].pWildcards[iIter2].cVariableName2 + 'A'); ++ printf("%c", pSearch[iIter1].pWildcards[iIter2].ucVariableName2 + 'A'); + iVariable2WasPrinted = 1; + } + else +@@ -1421,7 +1426,12 @@ + #ifdef _WIN32 + _setmode(_fileno(stdin), _O_BINARY); + #else +- freopen(NULL, "rb", stdin); ++ fIn = freopen(NULL, "rb", stdin); ++ if (fIn == NULL) ++ { ++ fprintf(stderr, "error reopening stdin in binary mode\n"); ++ return -1; ++ } + #endif + + *potFileSize = 100 * 1024 * 1024; +@@ -1438,7 +1448,7 @@ + return -1; + } + #ifndef __WINNT__ +- fprintf(stderr, "Number of bytes read from stdin: %lld\n", otSizeRead); ++ fprintf(stderr, "Number of bytes read from stdin: %lld\n", (long long int) otSizeRead); + #else + fprintf(stderr, "Number of bytes read from stdin: %ld\n", otSizeRead); + #endif +@@ -1469,7 +1479,7 @@ + if ((*ppBuffer = malloc(*potFileSize)) == NULL) + { + #ifndef __WINNT__ +- fprintf(stderr, "file %s is too large %lld\n", pcArgFile, *potFileSize); ++ fprintf(stderr, "file %s is too large %lld\n", pcArgFile, (long long int) *potFileSize); + #else + fprintf(stderr, "file %s is too large %ld\n", pcArgFile, *potFileSize); + #endif +@@ -1723,6 +1733,41 @@ + } + } + ++void print_help() ++{ ++ fprintf(stderr, "Usage: XORSearch [-siuhkpwWLxrS] [-l length] [-n [-+]length] [-f search-file] [-e byte] [-d encodings] file [string|hex|rule]\n" ++ "XORSearch V1.11.4, search for a XOR, ROL, ROT, SHIFT or ADD encoded string in a file\n" ++ "Use filename - to read from stdin\n" ++ "Use -x when the file to search is a hexdump\n" ++ "Use -s to save the XOR, ROL, ROT, SHIFT or ADD encoded file containing the string\n" ++ "Use -l length to limit the number of printed characters (50 by default, 38 with option -p)\n" ++ "Use -i to ignore the case when searching\n" ++ "Use -u to search for Unicode strings (limited support)\n" ++ "Use -r to reverse the file before searching\n" ++ "Use -f to provide a file with search strings\n" ++ "Use -n [-+]length to print neighbouring characters (before & after the found keyword)\n" ++ "Use -h to search for hex strings\n" ++ "Use -k to decode with embedded keys\n" ++ "Use -S to print all strings\n" ++ "Use -p to search for PE-files\n" ++ "Use -w to search with wildcards\n" ++ "Use -W to search with embedded wildcards\n" ++ "Use -L to list embedded wildcards\n" ++ "Use -e to exclude a particular byte-value from encoding\n" ++ "Use -d to disable encoding(s) 1: XOR 2: ROL 3: ROT 4: SHIFT 5: ADD\n" ++ "Options -l and -n are mutually exclusive\n" ++ "Options -u and -h are mutually exclusive\n" ++ "Options -k and -e are mutually exclusive\n" ++ "Option -p is not compatible with options -i, -u, -h, -n and -r\n" ++ "When using -p, do not provide a search string or use -f\n" ++ "When using -W, do not provide a search string or use -f\n" ++ "Use option -L without arguments or other options\n" ++ "Source code put in the public domain by Didier Stevens, no Copyright\n" ++ "Use at your own risk\n" ++ "https://DidierStevens.com\n"); ++} ++ ++ + int main(int argc, char **argv) + { + struct stat statFile; +@@ -1773,36 +1818,7 @@ + + if (ParseArgs(argc, argv, &iFlagSave, &iMaxLength, &iFlagIgnoreCase, &pcArgFile, &pcArgSearch, &pcArgSearchFile, &iFlagUnicode, &sNUMBERNeighbourLength, &iFlagHex, &iFlagKeys, &iFlagPEFile, &iExcludeByte, &iFlagWildcard, &iFlagWildcardEmbedded, &pcDisable, &iFlagList, &iFlagHexFile, &iFlagReverse, &iFlagStrings)) + { +- fprintf(stderr, "Usage: XORSearch [-siuhkpwWLxrS] [-l length] [-n [-+]length] [-f search-file] [-e byte] [-d encodings] file [string|hex|rule]\n" +- "XORSearch V1.11.4, search for a XOR, ROL, ROT, SHIFT or ADD encoded string in a file\n" +- "Use filename - to read from stdin\n" +- "Use -x when the file to search is a hexdump\n" +- "Use -s to save the XOR, ROL, ROT, SHIFT or ADD encoded file containing the string\n" +- "Use -l length to limit the number of printed characters (50 by default, 38 with option -p)\n" +- "Use -i to ignore the case when searching\n" +- "Use -u to search for Unicode strings (limited support)\n" +- "Use -r to reverse the file before searching\n" +- "Use -f to provide a file with search strings\n" +- "Use -n [-+]length to print neighbouring characters (before & after the found keyword)\n" +- "Use -h to search for hex strings\n" +- "Use -k to decode with embedded keys\n" +- "Use -S to print all strings\n" +- "Use -p to search for PE-files\n" +- "Use -w to search with wildcards\n" +- "Use -W to search with embedded wildcards\n" +- "Use -L to list embedded wildcards\n" +- "Use -e to exclude a particular byte-value from encoding\n" +- "Use -d to disable encoding(s) 1: XOR 2: ROL 3: ROT 4: SHIFT 5: ADD\n" +- "Options -l and -n are mutually exclusive\n" +- "Options -u and -h are mutually exclusive\n" +- "Options -k and -e are mutually exclusive\n" +- "Option -p is not compatible with options -i, -u, -h, -n and -r\n" +- "When using -p, do not provide a search string or use -f\n" +- "When using -W, do not provide a search string or use -f\n" +- "Use option -L without arguments or other options\n" +- "Source code put in the public domain by Didier Stevens, no Copyright\n" +- "Use at your own risk\n" +- "https://DidierStevens.com\n"); ++ print_help(); + return -1; + } + if (iMaxLength == -1) +@@ -1813,6 +1829,7 @@ + iMaxLength = 50; + } + ++ pSearch = NULL; + if (iFlagList) + { + pSearch = InitializeSearch(NULL, NULL, 1); +@@ -1892,7 +1909,7 @@ + if ((pBufferCopy = malloc(otFileSize)) == NULL) + { + #ifndef __WINNT__ +- fprintf(stderr, "file %s is too large %lld\n", pcArgFile, otFileSize); ++ fprintf(stderr, "file %s is too large %lld\n", pcArgFile, (long long int) otFileSize); + #else + fprintf(stderr, "file %s is too large %ld\n", pcArgFile, otFileSize); + #endif +@@ -1915,7 +1932,7 @@ + if ((pui32bitKeys = malloc(uiSize32bitKeys * sizeof(unsigned int))) == NULL) + { + #ifndef __WINNT__ +- fprintf(stderr, "file %s is too large for copy %lld\n", pcArgFile, otFileSize); ++ fprintf(stderr, "file %s is too large for copy %lld\n", pcArgFile, (long long int) otFileSize); + #else + fprintf(stderr, "file %s is too large for copy %ld\n", pcArgFile, otFileSize); + #endif +@@ -1943,7 +1960,7 @@ + if ((piFoundIndex = (int *)malloc(otFileSize * sizeof(int))) == NULL) + { + #ifndef __WINNT__ +- fprintf(stderr, "file %s is too large %lld\n", pcArgFile, otFileSize); ++ fprintf(stderr, "file %s is too large %lld\n", pcArgFile, (long long int) otFileSize); + #else + fprintf(stderr, "file %s is too large %ld\n", pcArgFile, otFileSize); + #endif +@@ -1957,7 +1974,7 @@ + if ((piFoundSize = (int *)malloc(otFileSize * sizeof(int))) == NULL) + { + #ifndef __WINNT__ +- fprintf(stderr, "file %s is too large %lld\n", pcArgFile, otFileSize); ++ fprintf(stderr, "file %s is too large %lld\n", pcArgFile, (long long int) otFileSize); + #else + fprintf(stderr, "file %s is too large %ld\n", pcArgFile, otFileSize); + #endif diff --git a/xorsearch.spec b/xorsearch.spec new file mode 100644 index 0000000..1265168 --- /dev/null +++ b/xorsearch.spec @@ -0,0 +1,130 @@ +Name: xorsearch +Version: 1.11.4 +Release: 10%{?dist} +Summary: Search for a given string in an XOR, ROL, ROT or SHIFT encoded binary file + +# Automatically converted from old format: Public Domain - needs further work +License: LicenseRef-Callaway-Public-Domain +URL: http://blog.didierstevens.com/programs/xorsearch/ + +%global pkgver %(echo %{version} | sed 's/\\./_/g') +# Source0: http://didierstevens.com/files/software/XORSearch_V%%{pkgver}.zip +Source0: https://github.com/DidierStevens/FalsePositives/raw/master/XORSearch_V%{pkgver}.zip +Patch0: %{name}-cosmetics.patch + +BuildRequires: gcc + +%description +XORSearch is a program to search for a given string in an XOR, ROL, ROT or SHIFT +encoded binary file. An XOR encoded binary file is a file where some (or all) +bytes have been XORed with a constant value (the key). A ROL (or ROR) encoded +file has its bytes rotated by a certain number of bits (the key). A ROT encoded +file has its alphabetic characters (A-Z and a-z) rotated by a certain number +of positions. A SHIFT encoded file has its bytes shifted left by a certain +number of bits (the key): all bits of the first byte shift left, the MSB +of the second byte becomes the LSB of the first byte, all bits of the second +byte shift left, … XOR and ROL/ROR encoding is used by malware programmers +to obfuscate strings like URLs. + + +%prep +%autosetup -v -c -n %{name}-%{version} +#remove binaries +rm -rf OSX Linux XORSearch.exe + +%build +# gcc %{optflags} -Wno-trigraphs XORSearch.c -o %{name} +gcc %{optflags} -Wno-trigraphs -D __APPLE__=1 XORSearch.c -o %{name} + + +%install +#Targetting EPEL as well +rm -rf "%{buildroot}" +install -m 755 -D %{name} "%{buildroot}/%{_bindir}/%{name}" + + +%files +%{_bindir}/%{name} + +%changelog +* Fri Jul 17 2026 Fedora Release Engineering - 1.11.4-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild + +* Sat Jan 17 2026 Fedora Release Engineering - 1.11.4-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + +* Fri Jul 25 2025 Fedora Release Engineering - 1.11.4-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Sun Jan 19 2025 Fedora Release Engineering - 1.11.4-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Sat Jul 20 2024 Fedora Release Engineering - 1.11.4-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Sat Jan 27 2024 Fedora Release Engineering - 1.11.4-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Sat Jul 22 2023 Fedora Release Engineering - 1.11.4-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Sat Jan 21 2023 Fedora Release Engineering - 1.11.4-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Sat Jul 23 2022 Fedora Release Engineering - 1.11.4-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Thu Jun 23 2022 Michal Ambroz 1.11.4-1 +- bump to 1.11.4 + +* Sat Jan 22 2022 Fedora Release Engineering - 1.11.2-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Fri Jul 23 2021 Fedora Release Engineering - 1.11.2-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Thu Jan 28 2021 Fedora Release Engineering - 1.11.2-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Wed Jul 29 2020 Fedora Release Engineering - 1.11.2-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Fri Jan 31 2020 Fedora Release Engineering - 1.11.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Mon Aug 12 2019 Michal Ambroz 1.11.2-1 +- bump to 1.11.2 +- patch the off_t -> size_t, string formatting of size_t, using the fread return code + +* Sat Jul 27 2019 Fedora Release Engineering - 1.11.1-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Sun Feb 03 2019 Fedora Release Engineering - 1.11.1-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Sat Jul 14 2018 Fedora Release Engineering - 1.11.1-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Fri Feb 09 2018 Fedora Release Engineering - 1.11.1-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Thu Aug 03 2017 Fedora Release Engineering - 1.11.1-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + +* Thu Jul 27 2017 Fedora Release Engineering - 1.11.1-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Sat Feb 11 2017 Fedora Release Engineering - 1.11.1-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + +* Mon Aug 01 2016 Michal Ambroz 1.11.1-3 +- fix EPEL5 build + +* Mon Aug 01 2016 Michal Ambroz 1.11.1-2 +- changes based on package review by Filip Szymański + +* Mon Apr 25 2016 Michal Ambroz 1.11.1-1 +- bump version + +* Sat Feb 16 2013 Michal Ambroz 1.0-1 +- initial build for Fedora