XORSearch is a program to search for a given string in an XOR, ROL, ROT or SHIFT encoded binary file. An XOR encoded binary file is a file where some (or all) bytes have been XORed with a constant value (the key). A ROL (or ROR) encoded file has its bytes rotated by a certain number of bits (the key). A ROT encoded file has its alphabetic characters (A-Z and a-z) rotated by a certain number of positions. A SHIFT encoded file has its bytes shifted left by a certain number of bits (the key): all bits of the first byte shift left, the MSB of the second byte becomes the LSB of the first byte, all bits of the second byte shift left, … XOR and ROL/ROR encoding is used by malware programmers to obfuscate strings like URLs.
XORSearch will try all XOR keys (0 to 255), ROL keys (1 to 7), ROT keys (1 to 25) and SHIFT keys (1 to 7) when searching. I programmed XORSearch to include key 0, because this allows to search in an unencoded binary file (X XOR 0 equals X).
If the search string is found, XORSearch will print it until the 0 (byte zero) is encountered or until 50 characters have been printed, which ever comes first. 50 is the default value, it can be changed with option -l. Unprintable characters are replaced by a dot.
Usage: XORSearch [-siuh] [-l length] [-n length] [-f search-file] file string XORSearch V1.8, search for a XOR, ROL, ROT or SHIFT encoded string in a file Use -s to save the XOR, ROL, ROT or SHIFT encoded file containing the string Use -l length to limit the number of printed characters (50 by default) Use -i to ignore the case when searching Use -u to search for Unicode strings (limited support) Use -f to provide a file with search strings Use -n length to print the length neighbouring charaters (before & after the found keyword) Use -h to search for hex strings Options -l and -n are mutually exclusive Options -u and -h are mutually exclusive Source code put in the public domain by Didier Stevens, no Copyright Use at your own risk https://DidierStevens.com
Compiled with Borland’s free C++ 5.5 compiler, Linux gcc and Xcode gcc.