import re,sys fw=open('files/balance_flash.bin','rb').read() salt=fw[0x1d434:0x1d43c] def rc4(key,data): S=list(range(256));j=0 for i in range(256): j=(j+S[i]+key[i%len(key)])&0xff; S[i],S[j]=S[j],S[i] i=j=0;out=[] for b in data: i=(i+1)&0xff;j=(j+S[i])&0xff;S[i],S[j]=S[j],S[i] out.append(b^S[(S[i]+S[j])&0xff]) return bytes(out) chunks={} for line in open(sys.argv[1] if len(sys.argv)>1 else 'dec.out'): m=re.search(r'APS 400101fc04010a..15ee1b..01(..)(..)(..)([0-9a-f]+)$',line.strip()) if m: ln,idx,tot,d=m.groups(); chunks[int(idx,16)]=bytes.fromhex(d)[:int(ln,16)-2] ieee=bytes.fromhex('c48746feffca4c40') for name,mac in [('le',ieee),('be',ieee[::-1])]: pt=b''.join(rc4(mac+salt+bytes([i]),chunks[i]) for i in sorted(chunks)) print(name,pt)