From owner-cvs-all@FreeBSD.ORG Mon Dec 17 20:33:59 2007 Return-Path: Delivered-To: cvs-all@FreeBSD.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 96F6B16A417; Mon, 17 Dec 2007 20:33:59 +0000 (UTC) (envelope-from edwin@FreeBSD.org) Received: from repoman.freebsd.org (repoman.freebsd.org [IPv6:2001:4f8:fff6::29]) by mx1.freebsd.org (Postfix) with ESMTP id 920A313C447; Mon, 17 Dec 2007 20:33:59 +0000 (UTC) (envelope-from edwin@FreeBSD.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.14.1/8.14.1) with ESMTP id lBHKXxX1072599; Mon, 17 Dec 2007 20:33:59 GMT (envelope-from edwin@repoman.freebsd.org) Received: (from edwin@localhost) by repoman.freebsd.org (8.14.1/8.14.1/Submit) id lBHKXxTb072598; Mon, 17 Dec 2007 20:33:59 GMT (envelope-from edwin) Message-Id: <200712172033.lBHKXxTb072598@repoman.freebsd.org> From: Edwin Groothuis Date: Mon, 17 Dec 2007 20:33:59 +0000 (UTC) To: ports-committers@FreeBSD.org, cvs-ports@FreeBSD.org, cvs-all@FreeBSD.org X-FreeBSD-CVS-Branch: HEAD Cc: Subject: cvs commit: ports/security Makefile ports/security/xorsearch Makefile distinfo pkg-descr ports/security/xorsearch/files patch-XORSearch.c X-BeenThere: cvs-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: CVS commit messages for the entire tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Dec 2007 20:33:59 -0000 edwin 2007-12-17 20:33:59 UTC FreeBSD ports repository Modified files: security Makefile Added files: security/xorsearch Makefile distinfo pkg-descr security/xorsearch/files patch-XORSearch.c Log: XORSearch XORSearch is a program to search for a given string in an XOR or ROL encoded binary file. An XOR encoded binary file is a file where some (or all) bytes have been XORed with a constant value (the key). A ROL (or ROR) encoded file has it bytes rotated by a certain number of bits (the key). XOR and ROL/ROR encoding is used by malware programmers to obfuscate strings like URLs. XORSearch will try all XOR keys (0 to 255) and ROL keys (1 to 7) when searching. I programmed XORSearch to include key 0, because this allows to search in an unencoded binary file (X XOR 0 equals X). If the search string is found, XORSearch will print it until the 0 (byte zero) is encountered or until 50 characters have been printed, which ever comes first. 50 is the default value, it can be changed with option -l. Unprintable characters are replaced by a dot. WWW: http://blog.didierstevens.com/programs/xorsearch/ Author: Didier Stevens Revision Changes Path 1.929 +1 -0 ports/security/Makefile 1.1 +28 -0 ports/security/xorsearch/Makefile (new) 1.1 +3 -0 ports/security/xorsearch/distinfo (new) 1.1 +10 -0 ports/security/xorsearch/files/patch-XORSearch.c (new) 1.1 +19 -0 ports/security/xorsearch/pkg-descr (new)