UMSKT
/
peacestone
mirror of https://github.com/UMSKT/peacestone.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
Defeating WARBIRD with one stone
13 Commits 1 Branch 0 Tags 438 KiB
Python 100%
Go to file
WitherOrNot 3e6e17ab7d
Remove debug prints 		2023-08-19 05:05:02 -04:00
README.md Create README.md 2023-08-18 20:07:58 -04:00
notes.txt update 2023-07-30 14:05:52 -04:00
notes2.txt implement control flow 2023-08-14 12:58:18 -04:00
obf_block_data.hexpat update 2023-07-30 14:05:52 -04:00
peacestone.py Remove debug prints 2023-08-19 05:05:02 -04:00
requirements.txt add requirements 2023-08-18 19:56:42 -04:00
sppsvc.yml upload 2023-07-16 22:58:47 -04:00

README.md

peacestone

The antithesis of the WARBIRD obfuscator (Vista-7 only).

Join our Zulip chat to discuss findings made with this tool!

Installation/Usage

  1. Run pip install --user -r requirements.txt
  2. Download rootfs from here. Extract rootfs/Windows to the peacestone folder.
  3. Place the program to be deobfuscated in the peacestone folder.
  4. Place the corresponding PDB file for the program in the same folder. Ensure the PDB has the same name as the program.
  5. Run python peacestone.py <program to deobfuscate>
  6. Enjoy!

Notes

This program has only been tested on files from Windows Server 2003 KMS Server version 1.0. If you encounter any bugs with other files, feel free to report them.

Special Thanks

  • Guy who compiled every single activation library into sppsvc.exe for no reason
  • Guy who forgot to remove WARBIRD symbols and encrypted function symbols from the public PDB
  • Guy(s) who left the PDBs up for 17 years