diff --git a/README.md b/README.md new file mode 100644 index 0000000..e6afacd --- /dev/null +++ b/README.md @@ -0,0 +1,24 @@ +# peacestone + +> The antithesis of the WARBIRD obfuscator (Vista-7 only). + +Join our [Zulip chat](https://umskt.zulipchat.com/) to discuss findings made with this tool! + +## Installation/Usage + +1. Run `pip install --user -r requirements.txt` +2. Download rootfs [from here](https://files.catbox.moe/hzmla1.7z). Extract `rootfs/Windows` to the `peacestone` folder. +3. Place the program to be deobfuscated in the `peacestone` folder. +4. Place the corresponding PDB file for the program in the same folder. Ensure the PDB has the same name as the program. +5. Run `python peacestone.py ` +6. Enjoy! + +## Notes + +This program has only been tested on files from Windows Server 2003 KMS Server version 1.0. If you encounter any bugs with other files, feel free to report them. + +## Special Thanks + + - Guy who compiled every single activation library into `sppsvc.exe` for no reason + - Guy who forgot to remove WARBIRD symbols and encrypted function symbols from the public PDB + - Guy(s) who left the PDBs up for 17 years