#!/usr/bin/env python3
"""
MP4 stco box decryptor
The ransomware adds 0x539 to each chunk offset in stco box
We need to subtract 0x539 to decrypt
"""

import struct
import sys
import os

def decrypt_stco(input_file, output_file):
    """Decrypt MP4 file by fixing stco chunk offsets"""

    print(f"Reading file: {input_file}")
    with open(input_file, 'rb') as f:
        data = bytearray(f.read())

    file_size = len(data)
    print(f"File size: {file_size} bytes")

    # Search for all stco boxes
    stco_count = 0
    offset = 0

    while offset < file_size - 8:
        # Look for 'stco' marker
        if data[offset:offset+4] == b'stco':
            print(f"\n{'='*60}")
            print(f"Found stco box at offset {offset}")

            # Read box size (4 bytes before stco)
            if offset < 4:
                offset += 1
                continue

            box_size = struct.unpack_from('>I', data, offset - 4)[0]
            print(f"Box size: {box_size}")

            if box_size < 12 or box_size > 1000000:
                print(f"Invalid box size, skipping")
                offset += 1
                continue

            # Read version/flags (4 bytes after stco)
            version = data[offset + 4]
            print(f"Version: {version}")

            # Read entry count (4 bytes after version)
            entry_count = struct.unpack_from('>I', data, offset + 8)[0]
            print(f"Entry count: {entry_count}")

            if entry_count == 0 or entry_count > 100000:
                print(f"Invalid entry count, skipping")
                offset += 1
                continue

            # Decrypt each chunk offset
            print(f"Decrypting {entry_count} chunk offsets...")
            decrypted = 0

            for i in range(entry_count):
                entry_offset = offset + 12 + (i * 4)

                if entry_offset + 4 > file_size:
                    print(f"Warning: Entry {i} beyond file end")
                    break

                # Read current (encrypted) offset
                enc_offset = struct.unpack_from('>I', data, entry_offset)[0]

                # Decrypt: subtract 0x539
                dec_offset = enc_offset - 0x539

                # Verify the decrypted offset is valid
                if dec_offset > 0 and dec_offset < file_size:
                    struct.pack_into('>I', data, entry_offset, dec_offset)
                    decrypted += 1

                    if i < 3:  # Show first 3 entries
                        print(f"  Entry {i:3d}: {enc_offset:10d} -> {dec_offset:10d} (0x{dec_offset:08X})")
                else:
                    if i < 3:
                        print(f"  Entry {i:3d}: {enc_offset:10d} -> SKIPPED (invalid: {dec_offset})")

            print(f"✓ Decrypted {decrypted}/{entry_count} entries")
            stco_count += 1

            # Move to next box
            offset += box_size
        else:
            offset += 1

    if stco_count == 0:
        print("\n⚠ No stco boxes found!")
        return False

    # Write decrypted file
    print(f"\n{'='*60}")
    print(f"Writing decrypted file: {output_file}")
    with open(output_file, 'wb') as f:
        f.write(data)

    print(f"✓ Decryption complete!")
    print(f"  Processed {stco_count} stco box(es)")
    return True

def batch_decrypt(directory):
    """Decrypt all MP4 files in directory"""
    mp4_files = [f for f in os.listdir(directory) if f.endswith('.mp4') and '_decrypted' not in f and '_repaired' not in f]

    print(f"Found {len(mp4_files)} MP4 files")
    print("="*60)

    for mp4_file in mp4_files:
        input_path = os.path.join(directory, mp4_file)
        output_path = os.path.join(directory, mp4_file.replace('.mp4', '_decrypted.mp4'))

        print(f"\n{'='*60}")
        print(f"Processing: {mp4_file}")
        print(f"{'='*60}")

        try:
            decrypt_stco(input_path, output_path)
        except Exception as e:
            print(f"ERROR: {str(e)}")

if __name__ == '__main__':
    if len(sys.argv) < 2:
        print("Usage: python decrypt_stco.py <input.mp4> [output.mp4]")
        print("       python decrypt_stco.py --batch <directory>")
        sys.exit(1)

    if sys.argv[1] == '--batch':
        batch_decrypt(sys.argv[2] if len(sys.argv) > 2 else '.')
    else:
        input_file = sys.argv[1]
        output_file = sys.argv[2] if len(sys.argv) > 2 else input_file.replace('.mp4', '_decrypted.mp4')

        if not os.path.exists(input_file):
            print(f"ERROR: File not found: {input_file}")
            sys.exit(1)

        success = decrypt_stco(input_file, output_file)
        if not success:
            sys.exit(1)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
WPS 表格形状点阵隐写解密脚本
用法: python decrypt_stego.py <et文件路径>

支持任意通过 Shape.AlternativeText 隐写坐标的 .et 文件，
自动提取嵌入 ZIP 中的 shapexml.xml，解密 descr 密文，
匹配字模表还原隐藏字符串。

依赖: pip install olefile
"""

import sys
import io
import re
import zipfile
import olefile
from collections import defaultdict

# 自定义字模表（来自 execelcrypt.txt 中的 _0xfont 定义）
FONT = {
    '0': [[1,0],[2,0],[0,1],[3,1],[0,2],[3,2],[0,3],[3,3],[1,4],[2,4]],
    '1': [[2,0],[1,1],[2,1],[2,2],[2,3],[1,4],[2,4],[3,4]],
    '2': [[1,0],[2,0],[0,1],[3,1],[2,2],[1,3],[0,4],[1,4],[2,4],[3,4]],
    '3': [[0,0],[1,0],[2,0],[3,1],[1,2],[2,2],[3,3],[0,4],[1,4],[2,4]],
    '4': [[3,0],[2,1],[3,1],[1,2],[3,2],[0,3],[1,3],[2,3],[3,3],[4,3],[3,4]],
    '5': [[0,0],[1,0],[2,0],[0,1],[0,2],[1,2],[2,2],[3,3],[0,4],[1,4],[2,4]],
    '6': [[1,0],[2,0],[0,1],[0,2],[1,2],[2,2],[0,3],[3,3],[1,4],[2,4]],
    '7': [[0,0],[1,0],[2,0],[3,0],[3,1],[2,2],[1,3],[1,4]],
    '8': [[1,0],[2,0],[0,1],[3,1],[1,2],[2,2],[0,3],[3,3],[1,4],[2,4]],
    '9': [[1,0],[2,0],[0,1],[3,1],[1,2],[2,2],[3,2],[3,3],[2,4]],
    'a': [[1,2],[2,2],[3,2],[0,3],[3,3],[1,4],[2,4],[3,4]],
    'b': [[0,0],[0,1],[0,2],[1,2],[2,2],[0,3],[3,3],[0,4],[1,4],[2,4]],
    'c': [[1,0],[2,0],[3,0],[0,1],[0,2],[0,3],[1,4],[2,4],[3,4]],
    'd': [[3,0],[3,1],[1,2],[2,2],[3,2],[0,3],[3,3],[1,4],[2,4],[3,4]],
    'e': [[1,0],[2,0],[0,1],[0,2],[1,2],[2,2],[0,3],[1,4],[2,4]],
    'f': [[1,0],[2,0],[1,1],[0,2],[1,2],[2,2],[1,3],[1,4]],
    'g': [[1,2],[2,2],[3,2],[0,3],[3,3],[1,4],[2,4],[3,4],[3,5],[1,6],[2,6]],
    'h': [[0,0],[0,1],[0,2],[1,2],[2,2],[0,3],[3,3],[0,4],[3,4]],
    'i': [[1,0],[1,2],[1,3],[1,4]],
    'j': [[2,0],[2,2],[2,3],[2,4],[2,5],[1,6],[0,5]],
    'k': [[0,0],[0,1],[0,2],[0,3],[0,4],[2,2],[1,3],[3,3],[2,4]],
    'l': [[1,0],[1,1],[1,2],[1,3],[1,4]],
    'm': [[0,1],[1,1],[2,1],[3,1],[4,1],[0,2],[2,2],[4,2],[0,3],[4,3]],
    'n': [[0,1],[1,0],[2,0],[0,2],[3,2],[0,3],[3,3],[0,4],[3,4]],
    'o': [[1,1],[2,1],[0,2],[3,2],[1,3],[2,3]],
    'p': [[0,2],[1,2],[2,2],[0,3],[3,3],[0,4],[1,4],[2,4],[0,5],[0,6]],
    'q': [[1,2],[2,2],[0,3],[3,2],[3,3],[3,4],[3,5],[4,5]],
    'r': [[0,2],[0,3],[0,4],[1,2],[2,2]],
    's': [[1,0],[2,0],[3,0],[0,1],[1,2],[2,2],[3,3],[0,4],[1,4],[2,4]],
    't': [[1,0],[1,1],[1,2],[1,3],[1,4],[0,2],[2,2]],
    'u': [[0,2],[0,3],[3,2],[3,3],[1,4],[2,4],[3,4]],
    'v': [[0,0],[4,0],[1,2],[3,2],[2,4]],
    'w': [[0,2],[0,3],[1,4],[2,3],[3,4],[4,2],[4,3]],
    'x': [[0,0],[4,0],[1,1],[3,1],[2,2],[1,3],[3,3],[0,4],[4,4]],
    'y': [[0,0],[4,0],[1,1],[3,1],[2,2],[2,3],[1,4]],
    'z': [[0,0],[1,0],[2,0],[3,0],[2,1],[1,2],[0,3],[0,4],[1,4],[2,4],[3,4]],
    ':': [[1,1],[1,3]],
    '@': [[1,0],[2,0],[0,1],[3,1],[0,2],[2,2],[3,2],[0,3],[1,4],[2,4]],
    '.': [[1,4]]
}

def extract_descr_values(et_path, xor_key=85, offset=100):
    """
    从 .et 文件中提取所有形状的 descr 密文值

    参数:
        et_path: .et 文件路径
        xor_key: 异或密钥（默认 85）
        offset: 坐标偏移量（默认 100）

    返回:
        排序后的密文整数列表
    """
    ole = olefile.OleFileIO(et_path)
    workbook = ole.openstream('Workbook').read()

    # 通过 ZIP 结束签名定位所有嵌入的 ZIP 包
    end_sig = b'PK\x05\x06'
    end_offsets = [m.start() for m in re.finditer(re.escape(end_sig), workbook)]

    shapes = []
    for end_off in end_offsets:
        try:
            cd_offset = int.from_bytes(workbook[end_off+16:end_off+20], 'little')
            cd_size   = int.from_bytes(workbook[end_off+12:end_off+16], 'little')
            zip_start = end_off - cd_offset - cd_size
            if zip_start < 0 or zip_start >= end_off:
                continue

            zip_data = workbook[zip_start:end_off+22]
            z = zipfile.ZipFile(io.BytesIO(zip_data))

            if 'drs/shapexml.xml' in z.namelist():
                data = z.read('drs/shapexml.xml').decode('utf-8')
                m = re.search(r'id="(\d+)"\s+name="([^"]+)"(?:\s+descr="([^"]+)")?', data)
                if m and m.group(3):
                    shapes.append((int(m.group(1)), m.group(3)))
        except Exception:
            continue

    shapes.sort(key=lambda x: x[0])
    return [int(descr) for _, descr in shapes]

def decrypt_coords(numbers, xor_key=85, offset=100):
    """
    将密文数字还原为 (x, y) 坐标列表

    解密公式:
        a = N // 1000
        b = N % 1000
        x = (a XOR xor_key) - offset
        y = (b XOR xor_key) - offset
    """
    coords = []
    for N in numbers:
        a = N // 1000
        b = N % 1000
        x = (a ^ xor_key) - offset
        y = (b ^ xor_key) - offset
        coords.append((x, y))
    return coords

def coords_to_text(coords, char_width=25, scale=4):
    """
    将坐标还原为字符串

    参数:
        coords: (x, y) 坐标列表
        char_width: 字符基线间距（默认 25）
        scale: 点阵缩放因子（默认 4）

    还原逻辑:
        字符索引 i = x // char_width
        相对水平偏移 mx = (x % char_width) // scale
        相对垂直偏移 my = y // scale
    """
    # 按字符索引分组
    groups = defaultdict(list)
    for x, y in coords:
        ci = x // char_width
        mx = (x % char_width) // scale
        my = y // scale
        groups[ci].append((mx, my))

    # 构建字模查找表：排序后的点集元组 -> 字符
    font_map = {}
    for ch, matrix in FONT.items():
        key = tuple(sorted(tuple(p) for p in matrix))
        font_map[key] = ch

    # 逐字符匹配
    result = []
    for ci in sorted(groups.keys()):
        pts = tuple(sorted(groups[ci]))
        ch = font_map.get(pts, '?')
        result.append(ch)

    return ''.join(result)

def main():
    # ---- 命令行参数解析 ----
    if len(sys.argv) < 2:
        print(f"用法: python {sys.argv[0]} <et文件路径> [--xor-key 85] [--offset 100] [--char-width 25] [--scale 4]")
        print()
        print("参数说明:")
        print("  et文件路径       必填，要解密的 .et 文件路径")
        print("  --xor-key N      异或密钥，默认 85")
        print("  --offset N       坐标偏移量，默认 100")
        print("  --char-width N   字符基线间距，默认 25")
        print("  --scale N        点阵缩放因子，默认 4")
        sys.exit(1)

    et_path = sys.argv[1]

    # 解析可选参数
    kwargs = {}
    i = 2
    while i < len(sys.argv):
        if sys.argv[i] == '--xor-key' and i + 1 < len(sys.argv):
            kwargs['xor_key'] = int(sys.argv[i + 1])
            i += 2
        elif sys.argv[i] == '--offset' and i + 1 < len(sys.argv):
            kwargs['offset'] = int(sys.argv[i + 1])
            i += 2
        elif sys.argv[i] == '--char-width' and i + 1 < len(sys.argv):
            kwargs['char_width'] = int(sys.argv[i + 1])
            i += 2
        elif sys.argv[i] == '--scale' and i + 1 < len(sys.argv):
            kwargs['scale'] = int(sys.argv[i + 1])
            i += 2
        else:
            print(f"[!] 未知参数: {sys.argv[i]}")
            sys.exit(1)

    # 分离 decrypt_coords 和 coords_to_text 的参数
    decrypt_kwargs = {k: v for k, v in kwargs.items() if k in ('xor_key', 'offset')}
    text_kwargs = {k: v for k, v in kwargs.items() if k in ('char_width', 'scale')}

    # ---- 执行解密 ----
    print(f'[*] 目标文件: {et_path}')
    print('[*] 提取形状密文...')

    try:
        numbers = extract_descr_values(et_path, **decrypt_kwargs)
    except Exception as e:
        print(f'[!] 文件读取失败: {e}')
        sys.exit(1)

    if not numbers:
        print('[!] 未找到有效的形状数据（descr 为空或文件不含 shapexml.xml）')
        sys.exit(1)

    print(f'[+] 共提取 {len(numbers)} 个密文数字')
    print(f'    范围: {min(numbers)} ~ {max(numbers)}')

    print('[*] 解密坐标...')
    coords = decrypt_coords(numbers, **decrypt_kwargs)

    # 输出坐标范围，辅助判断参数是否正确
    xs = [c[0] for c in coords]
    ys = [c[1] for c in coords]
    print(f'    x 范围: {min(xs)} ~ {max(xs)}')
    print(f'    y 范围: {min(ys)} ~ {max(ys)}')

    # 如果所有坐标都是负数或异常大，提示参数可能不对
    if min(xs) < -50 or min(ys) < -50:
        print('[!] 坐标出现较大负值，可能异或密钥或偏移量参数不正确')

    print('[*] 还原字符...')
    text = coords_to_text(coords, **text_kwargs)

    print(f'\n{"="*50}')
    print(f'[+] 还原结果: {text}')
    print(f'{"="*50}')

    # 尝试分离标签和密码（以冒号为分隔）
    if ':' in text:
        label, password = text.rsplit(':', 1)
        print(f'[+] 标签/提示: {label}')
        print(f'[+] 密码内容: {password}')
    else:
        print(f'[+] 完整内容: {text}')

    # 统计未识别字符
    unknown_count = text.count('?')
    if unknown_count > 0:
        print(f'[!] 有 {unknown_count} 个字符未能在字模表中匹配，可能参数有误或字模表不完整')

if __name__ == '__main__':
    main()