-- Rich Signature Decrypter -- © 2008 Daniel Pistelli filename = GetOpenFile() if filename == null then return end hFile = OpenFile(filename) if hFile == null then return end nSignDwords = 0 for i = 0, 100 do dw = ReadDword(hFile, 0x80 + (i * 4)) if dw == null then return end -- is this the "Rich" terminator? if dw == 0x68636952 then nSignDwords = i break end end if nSignDwords == 0 then return end -- read xor mask mask = ReadDword(hFile, 0x80 + ((nSignDwords + 1) * 4)) -- decrypt signature for i = 0, nSignDwords - 1 do dw = ReadDword(hFile, 0x80 + (i * 4)) WriteDword(hFile, 0x80 + (i * 4), dw ^ mask) end -- write new mask for decrypted signature WriteDword(hFile, 0x80 + ((nSignDwords + 1) * 4), 0xFFFFFFFF) -- save file if SaveFile(hFile) == true then OpenWithCFFExplorer(filename) end