1
#!/usr/bin/env python3
2

3
# ============================================================
4
# Malware API Hash Resolver
5
# ============================================================
6
#
7
# Usage:
8
#   python3 resolve_hashes.py hashes.txt
9
#
10
# hashes.txt:
11
#   0xFCB67412
12
#   0x12345678
13
#
14
# Environment:
15
#   WSL + Windows DLLs from:
16
#       /mnt/c/Windows/System32
17
#
18
# ============================================================
19

20
import os
21
import sys
22
import pefile
23

24
SYSTEM32 = "/mnt/c/Windows/System32"
25

26
# ------------------------------------------------------------
27
# DLLs to parse
28
# ------------------------------------------------------------
29

30
COMMON_DLLS = [
31
    "kernel32.dll",
32
    "kernelbase.dll",
33
    "ntdll.dll",
34
    "advapi32.dll",
35
    "user32.dll",
36
    "gdi32.dll",
37
    "ws2_32.dll",
38
    "wininet.dll",
39
    "urlmon.dll",
40
    "shell32.dll",
41
    "ole32.dll",
42
    "combase.dll",
43
    "crypt32.dll",
44
    "iphlpapi.dll",
45
    "shlwapi.dll",
46
    "psapi.dll",
47
    "sechost.dll",
48
    "bcrypt.dll",
49
    "rpcrt4.dll",
50
    "winhttp.dll",
51
    "setupapi.dll",
52
    "netapi32.dll",
53
    "dnsapi.dll",
54
    "wtsapi32.dll",
55
    "oleaut32.dll",
56
    "userenv.dll",
57
    "dbghelp.dll",
58
    "comdlg32.dll",
59
    "uxtheme.dll",
60
]
61
# ------------------------------------------------------------
62
# ROTL32
63
# ------------------------------------------------------------
64

65
def rol32(value, bits):
66

67
    bits &= 31
68

69
    if bits == 0:
70
        return value & 0xFFFFFFFF
71

72
    return ((value << bits) | (value >> (32 - bits))) & 0xFFFFFFFF
73

74

75
# ------------------------------------------------------------
76
# Malware hash algorithm
77
# ------------------------------------------------------------
78

79
def mw_hash(s):
80

81
    s = s.encode(errors="ignore")
82

83
    length = len(s)
84

85
    if length:
86

87
        edx = 0x75A887A5
88

89
        for i, c in enumerate(s):
90

91
            # lowercase conversion
92
            if 0x41 <= c <= 0x5A:
93
                c += 0x20
94

95
            ebx = ((c << 16) | c) & 0xFFFFFFFF
96

97
            eax = rol32(0x86679E7F, i)
98
            eax ^= ebx
99

100
            eax = (eax * 0xCEDEB46B) & 0xFFFFFFFF
101
            eax = rol32(eax, 8)
102

103
            eax = (eax * 0x9228D003) & 0xFFFFFFFF
104

105
            eax ^= edx
106

107
            eax = rol32(eax, 16)
108

109
            eax = (eax * 0xC10609A7) & 0xFFFFFFFF
110

111
            eax = (eax + 0x86679E7F) & 0xFFFFFFFF
112

113
            edx = eax ^ (eax >> 15)
114

115
    else:
116
        edx = 0x75A887A5
117

118
    edx ^= length
119

120
    eax = edx ^ (edx >> 16)
121
    eax = (eax * 0xC0A4F1EB) & 0xFFFFFFFF
122

123
    ecx = eax ^ (eax >> 13)
124

125
    eax = (ecx * 0x8DAA4A67) & 0xFFFFFFFF
126

127
    ecx = eax ^ (eax >> 16)
128

129
    ecx = (ecx * 0xCEDEB46B) & 0xFFFFFFFF
130

131
    eax = ecx ^ (ecx >> 15)
132

133
    return eax & 0xFFFFFFFF
134

135

136
# ------------------------------------------------------------
137
# Build export database
138
# ------------------------------------------------------------
139

140
def build_db():
141

142
    db = {}
143

144
    print("[*] Parsing DLL exports...\n")
145

146
    for dll in COMMON_DLLS:
147

148
        dll_path = os.path.join(SYSTEM32, dll)
149

150
        if not os.path.exists(dll_path):
151
            print(f"[-] Missing: {dll}")
152
            continue
153

154
        print(f"[+] {dll}")
155

156
        try:
157

158
            pe = pefile.PE(dll_path)
159

160
            if not hasattr(pe, "DIRECTORY_ENTRY_EXPORT"):
161
                continue
162

163
            for exp in pe.DIRECTORY_ENTRY_EXPORT.symbols:
164

165
                if not exp.name:
166
                    continue
167

168
                try:
169
                    api = exp.name.decode(errors="ignore")
170
                except:
171
                    continue
172

173
                h = mw_hash(api)
174

175
                if h not in db:
176
                    db[h] = []
177

178
                db[h].append(f"{dll}!{api}")
179

180
        except Exception as e:
181

182
            print(f"    ERROR: {e}")
183

184
    return db
185

186

187
# ------------------------------------------------------------
188
# Load hashes from file
189
# ------------------------------------------------------------
190

191
def load_hashes(path):
192

193
    hashes = []
194

195
    with open(path, "r") as f:
196

197
        for line in f:
198

199
            line = line.strip()
200

201
            if not line:
202
                continue
203

204
            try:
205
                hashes.append(int(line, 16))
206

207
            except:
208
                print(f"[-] Invalid hash: {line}")
209

210
    return hashes
211

212

213
# ------------------------------------------------------------
214
# Main
215
# ------------------------------------------------------------
216

217
def main():
218

219
    if len(sys.argv) != 2:
220
        print(f"Usage: {sys.argv[0]} hashes.txt")
221
        return
222

223
    hashes_file = sys.argv[1]
224

225
    hashes = load_hashes(hashes_file)
226

227
    print(f"[+] Loaded {len(hashes)} hashes\n")
228

229
    db = build_db()
230

231
    print("\n================ RESULTS ================\n")
232

233
    found = 0
234

235
    for h in hashes:
236

237
        print(f"0x{h:08X}")
238

239
        if h in db:
240

241
            found += 1
242

243
            for api in db[h]:
244
                print(f"    -> {api}")
245

246
        else:
247
            print("    -> NOT FOUND")
248

249
        print()
250

251
    print("=========================================")
252
    print(f"[+] Resolved: {found}/{len(hashes)}")
253
    print("=========================================")
254

255

256
if __name__ == "__main__":
257
    main()

1
import idautils, idaapi, idc, os
2

3
TARGET  = "mw_api_resolver"
4
OUTFILE = os.path.join(os.path.dirname(idaapi.get_input_file_path()), "hashes.txt")
5

6
def is_push_imm(ea):
7
    return idc.print_insn_mnem(ea).lower() == "push" and \
8
           idc.get_operand_type(ea, 0) == idaapi.o_imm
9

10
def find_hash(call_ea):
11
    ea, pushes = idc.prev_head(call_ea), 0
12
    for _ in range(12):
13
        if ea == idc.BADADDR: break
14
        if idc.print_insn_mnem(ea).lower() == "push":
15
            pushes += 1
16
            if pushes == 2:
17
                return (idc.get_operand_value(ea, 0) & 0xFFFFFFFF) if is_push_imm(ea) else None
18
        ea = idc.prev_head(ea)
19
    return None
20

21
target_ea = idc.get_name_ea_simple(TARGET)
22
if target_ea == idc.BADADDR:
23
    print(f"[-] '{TARGET}' not found — check label name")
24
else:
25
    hits, misses = [], []
26
    for xref in idautils.CodeRefsTo(target_ea, False):
27
        h = find_hash(xref)
28
        (hits if h else misses).append((xref, h))
29

30
    print(f"\n{'─'*45}")
31
    for ea, h in hits:
32
        print(f"  0x{ea:08X}  →  0x{h:08X}")
33
    print(f"{'─'*45}")
34
    print(f"  Resolved : {len(hits)}   |   Skipped : {len(misses)}")
35
    print(f"{'─'*45}\n")
36

37
    if hits:
38
        with open(OUTFILE, "w") as f:
39
            f.writelines(f"0x{h:08X}\n" for _, h in hits)
40
        print(f"[+] Saved → {OUTFILE}")

1
https[:]//telegra[.]ph/Parameters-04-03

1
tq[.]trxzidanp[.]icu