修改UPX特征码后upx -d脱壳，IDA分析，rc4改了轮数

并且key在加密之前修改了

解密脚本

unsigned char sbox[size] = {0};
void init_sbox(unsigned char *key)
{
unsigned int i, j, k;
int tmp;
for (i = 0; i < size; i++)
{
sbox[i] = i;
}
j = k = 0;
for (i = 0; i < size; i++)
{
tmp = sbox[i];
j = (j + tmp + key[k]) % size;
sbox[i] = sbox[j];
sbox[j] = tmp;
if (++k >= strlen((char *)key))
k = 0;
}
}
void encode(unsigned char *key, unsigned char *data)
{
int i, j, k, R, tmp;
init_sbox(key);
j = k = 0;
for (i = 0; i < strlen((char *)data); i++)
{
j = (j + 1) % size;
k = (k + sbox[j]) % size;
tmp = sbox[j];
sbox[j] = sbox[k];
sbox[k] = tmp;
R = sbox[(sbox[j] + sbox[k]) % size];
data[i] ^= R;
}
}
int main()
{
unsigned char a[] = {42, 35, 69, 104, 85, 10, 60, 34, 61, 57, 35, 119, 114, 50, 1
24, 92, 117, 65, 27, 87, 123, 112, 19, 79, 5, 51, 28, 0};
unsigned char key[20] = "Th1s_1s_Re@lly_k3y";
encode(key, buffer);
printf("%s", a);
3 / 4
return 0;
}