david_navigator 12 Posted February 9, 2023 I need to convert some python code to delphi, though my knowledge of python is somewhat thin. I've done most of what's needed but there's a part that I don't really understand. starting with _extract, it seems to call marsaglia_xorshift_128 but why does that have a while True & yield - is that so everything is treated as a persistent variable ? Does marsaglia_xorshift_128 effectively get called again for each byte in contents[12:16], from the deobfuscate_string so that w is the value from the "next" iteration ? How would I do something similar in delphi ? def marsaglia_xorshift_128(x = 123456789, y = 362436069, z = 521288629, w = 88675123): while True: t = (x ^ (x << 11)) & 0xffffffff x, y, z = y, z, w w = (w ^ (w >> 19) ^ (t ^ (t >> 8))) yield w # The lower 8-bits from the Xorshift PNR are subtracted from byte # values during extraction, and added to byte values on insertion. # When calling deobfuscate_string() the whole string is processed. def deobfuscate_string(pnr, obfuscated, operation=int.__sub__): return ''.join([chr((operation(ord(c), pnr.next())) & 0xff) for c in obfuscated]) def _extract(container_filename): ... ... ... contents = container.read(compressed_length) header_length, mangling_method, truncated_timestamp, original_length = struct.unpack('>HHLL', contents[:12]) assert header_length == 12 and mangling_method == 1 # The file contents are obfuscated with a Marsaglia xorshift PNR pnr = marsaglia_xorshift_128(x = truncated_timestamp, y = original_length) qcompress_prefix = deobfuscate_string(pnr, contents[12:16]) Share this post Link to post
david_navigator 12 Posted February 9, 2023 why didn't I think of asking #AI ?? can you explain what this python code does ? def marsaglia_xorshift_128(x = 123456789, y = 362436069, z = 521288629, w = 88675123): while True: t = (x ^ (x << 11)) & 0xffffffff x, y, z = y, z, w w = (w ^ (w >> 19) ^ (t ^ (t >> 8))) yield w This is a Python function that implements the Marsaglia Xorshift 128 random number generator algorithm. The function takes four parameters x, y, z, and w which serve as the seed values for the generator. The function contains an infinite loop that generates random numbers using the Xorshift 128 algorithm. The loop uses bitwise operations to perform the necessary calculations to generate a new random number on each iteration. The t variable is calculated by performing a bitwise XOR operation on x shifted left by 11 bits and x, and then taking the result and performing a bitwise AND with the hexadecimal value 0xffffffff. The purpose of this calculation is to produce a new value for t that is used in the calculation of the next random number. Next, x, y, and z are updated by taking the previous values of y, z, and w. w is then calculated by performing a series of bitwise XOR and right-shift operations. The yield statement returns the new value of w on each iteration of the loop. This allows the function to be used as a generator that can be used to produce an infinite sequence of random numbers. Each time the function is called with the same seed values, it will produce the same sequence of random numbers. To get a different sequence, the seed values must be changed. 1 Share this post Link to post