dfirfpi · May 4, 2017 22:55 · May 4, 2017
diff --git a/unssz.py b/unssz.py
@@ -0,0 +1,58 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+#
+# Copyright 2017, Francesco "dfirfpi" Picasso <[email protected]>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+"""Samsung Secret Zone MSR file decryptor."""
+
+from __future__ import print_function
+
+from Crypto.Cipher import AES
+import sys
+
+CHUNK_SIZE = 4096
+HEADER_SIZE = 16384
+# AES key, for different crypto algorithms, different keys.
+HEADER_KEY = '\x06\x42\x21\x98\x03\x69\x5E\xB1\x5F\x40\x60\x8C\x2E\x36\x00\x06'
+
+
+def main():
+    with open(sys.argv[1], 'rb') as input_file:
+        header_enc = input_file.read(HEADER_SIZE)
+        decryptor = AES.new(HEADER_KEY, AES.MODE_CBC, 16 * '\x00')
+        header_dec = decryptor.decrypt(header_enc)
+
+        body_decryption_key = header_dec[0x203c:0x204C]
+        print('Decoding key: {}'.format(body_decryption_key.encode('hex')))
+
+        if len(sys.argv) != 3:
+            print('No output file specified, giving up...')
+            sys.exit(0)
+
+        decryptor = AES.new(body_decryption_key, AES.MODE_ECB, 16 * '\00')
+
+        with open(sys.argv[2], 'wb') as output_file:
+            while True:
+                chunk_enc = input_file.read(CHUNK_SIZE)
+                if len(chunk_enc) == 0:
+                    break
+                chunk_dec = decryptor.decrypt(chunk_enc)
+                output_file.write(chunk_dec)
+                sys.stdout.write('.')
+                sys.stdout.flush()
+
+
+if __name__ == "__main__":
+    main()