---
name: xorsearch
version: 1.2.0
origin: security/xorsearch
comment: Search for a given string in an XOR or ROL encoded binary file
arch: freebsd:9:x86:64
www: http://blog.didierstevens.com/programs/xorsearch/
maintainer: edwin@mavetju.org
prefix: /usr/local
licenselogic: single
flatsize: 11344
desc: |
  XORSearch is a program to search for a given string in an XOR or
  ROL encoded binary file. An XOR encoded binary file is a file where
  some (or all) bytes have been XORed with a constant value (the key).
  A ROL (or ROR) encoded file has it bytes rotated by a certain number
  of bits (the key). XOR and ROL/ROR encoding is used by malware
  programmers to obfuscate strings like URLs.

  XORSearch will try all XOR keys (0 to 255) and ROL keys (1 to 7)
  when searching. I programmed XORSearch to include key 0, because
  this allows to search in an unencoded binary file (X XOR 0 equals
  X).

  If the search string is found, XORSearch will print it until the 0
  (byte zero) is encountered or until 50 characters have been printed,
  which ever comes first. 50 is the default value, it can be changed
  with option -l. Unprintable characters are replaced by a dot.

  Author: Didier Stevens
  WWW: http://blog.didierstevens.com/programs/xorsearch/
categories: [textproc, security]
files:
  /usr/local/bin/xorsearch: 3856c6337f21df2959c19709e2f5a610be7be0eefddff5c370b26b963ccec984
scripts: {}
