This python code is useful for strings that you need to work with in C code but if Microsoft Defender sees them, your tool might get flagged. List each string in input.txt, one per line. Then run this python script. After that, output.txt will contain each XOR-encoded string. Those strings can then be defined in your C code. You will need a decode function in C. I included it below the Python code here.<\/p>\n\n\n\n
# Set the key
key = 0xDD
# Set the input file containing the strings (one per line)
input_file = 'input.txt'
# Set the output file that will store the encoded strings
output_file = 'output.txt'
# Read in a list of strings to encode
with open(input_file, 'r', encoding='utf-8') as file:
strings = [string.strip() for string in file]
# Open the output file for writing
with open(output_file, 'w') as file:
# Read in each string and encode them saving the results to an output file
for string in strings:
encoded_string = [ord(character) ^ key for character in string]
hex_string = ', '.join([hex(byte) for byte in encoded_string])
file.write(f'\/\/ {string}\\n')
file.write(f'{hex_string}, 0x00\\n')<\/code><\/pre>\n\n\n\n\/\/ Simple XOR function to encode and decode strings in memory \nvoid xor_string(unsigned char* data, unsigned char key)\n{\n while (data && *data)\n {\n *data ^= key;\n data++;\n }\n}<\/pre>\n","protected":false},"excerpt":{"rendered":"This python code is useful for strings that you need to work with in C code but if Microsoft Defender sees them, your tool might get flagged. List each string in input.txt, one per line. Then run this python script. After that, output.txt will contain each XOR-encoded string. Those strings can then be defined in […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-container-style":"default","site-container-layout":"default","site-sidebar-layout":"default","site-transparent-header":"default","disable-article-header":"default","disable-site-header":"default","disable-site-footer":"default","disable-content-area-spacing":"default","footnotes":""},"categories":[16],"tags":[31],"class_list":["post-643","post","type-post","status-publish","format-standard","hentry","category-obfuscation","tag-xor"],"_links":{"self":[{"href":"https:\/\/offensivepython.com\/index.php\/wp-json\/wp\/v2\/posts\/643","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/offensivepython.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/offensivepython.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/offensivepython.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/offensivepython.com\/index.php\/wp-json\/wp\/v2\/comments?post=643"}],"version-history":[{"count":1,"href":"https:\/\/offensivepython.com\/index.php\/wp-json\/wp\/v2\/posts\/643\/revisions"}],"predecessor-version":[{"id":644,"href":"https:\/\/offensivepython.com\/index.php\/wp-json\/wp\/v2\/posts\/643\/revisions\/644"}],"wp:attachment":[{"href":"https:\/\/offensivepython.com\/index.php\/wp-json\/wp\/v2\/media?parent=643"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/offensivepython.com\/index.php\/wp-json\/wp\/v2\/categories?post=643"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/offensivepython.com\/index.php\/wp-json\/wp\/v2\/tags?post=643"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}