新型僵尸网络CatDDoS正在持续进化

import idcimport idaapiimport ida_hexraysfrom Crypto.Cipher import ChaCha20
def get_all_cfunc(eas):    ref = {}    for ea in eas:        cfunc = idaapi.decompile(ea)        if cfunc and hex(cfunc.entry_ea) not in ref:             ref[hex(cfunc.entry_ea)] = cfunc.body.cblock    return ref.keys(), ref.values()
def find_obj_ea(arg):    arg = arg.x    tp = arg.op_to_typename[arg.op]    if tp == "obj":        return arg.obj_ea    elif tp == "cast" or tp == "ref":        return find_obj_ea(arg)
def parse_arg(block):    if hasattr(block, "operands"):        if "a" in block.operands:            for arg in block.operands["a"]:                tp = arg.op_to_typename[arg.op]                if tp == "num":                    yield {"type": tp, "value": arg.numval()}                elif tp == "cast" or tp == "ref":                    yield {"type": tp, "value": find_obj_ea(arg)}                else:                    yield {"type": tp, "value": arg.operands}
def parse_expr(expr):    if expr.op_to_typename[expr.op] == "call":        if expr.ea in eas:            call_info[hex(expr.ea)] = []            for arg in parse_arg(expr):                call_info[hex(expr.ea)].append(arg)    else:        for operands in expr.operands.values():            if type(operands) is ida_hexrays.cexpr_t:                parse_expr(operands)

xor_add_func = 0x000000000403020key = 0x000000000051C0A0nonce = 0x000000000051C0C0
call_info = {}key = idc.GetManyBytes(key, 32)nonce = idc.GetManyBytes(nonce, 12)eas = list(CodeRefsTo(xor_add_func, False))xrefs, cfunc = get_all_cfunc(eas)print("found %s xrefs: %s" % (len(xrefs), list(xrefs)))for cblock in cfunc:    for cinsn in cblock:        op = cinsn.details        if issubclass(type(op), ida_hexrays.ceinsn_t) and type(op.expr) is ida_hexrays.cexpr_t:            parse_expr(op.expr)        elif type(op) is ida_hexrays.cexpr_t:            parse_expr(op)for k in call_info.keys():    if call_info[k][0]["type"] == "num" and call_info[k][1]["type"] in ["cast", "ref"] and call_info[k][2]["type"] == "num":        ciphertext = idc.GetManyBytes(call_info[k][1]["value"], call_info[k][2]["value"])        cipher = ChaCha20.new(key=key, nonce=nonce)        cipher.seek(64)        text = cipher.decrypt(ciphertext)        print("[%s]: %s" % (call_info[k][0]["value"], text))    else:        print("%s未知参数，解析失败：%s" % (k, call_info[k]))