deobfuscate.zig

const std = @import("std");
const c = @cImport(@cInclude("stdio.h"));

pub fn main() !void {
    const args = try std.process.argsAlloc(std.heap.page_allocator);
    if (args.len < 2) {
        std.debug.print("usage: {s} <binary path>\n", .{args[0]});
        return;
    }

    const fp = c.fopen(args[1], "rb") orelse return;
    defer _ = c.fclose(fp);
    _ = c.fseek(fp, 0, c.SEEK_END);
    const size: usize = @intCast(c.ftell(fp));
    _ = c.fseek(fp, 0, c.SEEK_SET);
    const content = try std.heap.page_allocator.alloc(u8, size);
    _ = c.fread(content.ptr, 1, size, fp);
    const pattern = [_]u8{ 0x1A, 0xD5, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
    var pos: usize = 0;
    var last_pos: ?usize = null;

    while (std.mem.indexOf(u8, content[pos..], &pattern)) |p| {
        last_pos = pos + p;
        pos = last_pos.? + 1;
    }

    const final_pos = last_pos orelse {
        std.debug.print("pattern not found\n", .{});
        return;
    };
    if (final_pos < 128) {
        std.debug.print("not enough bytes before pattern\n", .{});
        return;
    }

    const obf_bytes = content[final_pos - 128 .. final_pos];
    const obf_u16 = @as([*]u16, @ptrCast(@alignCast(obf_bytes.ptr)))[0..64];
    var server_public_key = [_]u8{0} ** 32;
    var i: u8 = 0;
    while (i < 16) : (i += 1) {
        const v16: u16 = obf_u16[31 - 2 * i + 32];
        const v17: u16 = (obf_u16[2 * i + 1] ^ v16) | (v16 ^ obf_u16[2 * i]);
        const shift_l: u4 = @intCast(11 - (i & 7));
        const shift_r: u4 = @intCast(((i & 7) -% 11) & 0xF);
        const rotated: u16 = (v17 << shift_l) | (v17 >> shift_r);
        const result: u16 = rotated ^ obf_u16[31 - i + 32];
        server_public_key[2 * i] = @intCast(result & 0xFF);
        server_public_key[2 * i + 1] = @intCast((result >> 8) & 0xFF);
    }
    for (server_public_key) |b| std.debug.print("{x:0>2}", .{b});
    std.debug.print("\n", .{});
}