10 lines
7.6 KiB
Plaintext
10 lines
7.6 KiB
Plaintext
# EF-Cheeto binary section: .data
|
|
# RVA: 0x3c5000
|
|
# Size: 5,632 bytes
|
|
# Raw offset in original DLL: 0x3c2c00
|
|
# To decode: import base64; data = base64.b64decode(open('ef_cheeto_section__data.b64').read().split('\n',5)[-1])
|
|
# ImageBase: 0x180000000
|
|
# VA = ImageBase + RVA
|
|
|
|
AAAAgP////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADKi3y2ZKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADNXSDSZtT/////////////AQAAAAIAAAAAAAgAAAAAAAAAAAIAAAAAdZgAAAAAAAABAAAAAAAAACBEDYABAAAAAwAAAAAAAABYRA2AAQAAAAcAAAAAAAAAAAAAAAAAAADQBjuAAQAAAAABAQABAAAAAAAAAAAAAAAAAAAAAAAAAKWqpbilqqWqpbiluKW4pbjAwMDAwMDAwKzAzMChoaGhsaWlpsDA19rgwOTA6urg4JjI7vGl06WloeqewMDCwOYDfxF/AX8BPwEBq4uQZFtbW1tbkltbdpCSkltbW1tbW1tbW1tbW2pzkFtSUlJSW1tbW3d8d4VbW3Bbeq92dltbW1tbW1tbW1tbhgEDAQQD1QPVA8wBvAPwAwMEAFBQUFD/ICAgIAEBAQHEAhD///8BAAMR/wPExsgCEAD/zAEBAQAAAAABAQMB///AwhARAgMBAQH///8AAAD/AAD/////EBAQEAIQAADGyAICAgIGAAQAAv8AwMIBAQMDA8pAAAoABAAAAAB/ADMBAAAAAAAA/7///wAAAAAHAAD/AAAAAAAAAAAAAAAAAAD//wAAAL8AAAAAAAAAAH8AAP9AQEBAQUlAQEBATEJAQEBAQEBAQE9EU0BAQERXQ1xAYEBAQEBAQEBAQEBAQEBAZGZua0BAakZAQERGQEBbREBAAAAAAAYGBgYBBgYCBgYABgAKCgAAAAIHBwYCDQYGBg4FBQICAAAEBAQEBQYGBgAAAA4AAAgAEAAYACAAKAAwAIABggGGAPbP/j+rALAAsQCzALr4uwDAAMEAx79i/wCN/wDE/wDF/wD//+sB/w4SCAATCQAWCAAXCQArCQCu/wey/wC0/wC1/wDDAQDH/7/nCADwAgAAAAAAAAAAdGVzdHlpcAAAAAAAAAAAAAcAAAAAAAAADwAAAAAAAABnYXRtcC50bXAAAAAAAAAACQAAAAAAAAAPAAAAAAAAAEVGLUNoZWV0by5kbGwAAAANAAAAAAAAAA8AAAAAAAAAAAAAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVmZvcm1hdF9lcnJvckBzdGRAQAAAaBENgAEAAAAAAAAAAAAAAC4/QVZiYWRfY2FzdEBzdGRAQAAAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWc3lzdGVtX2Vycm9yQHN0ZEBAAABoEQ2AAQAAAAAAAAAAAAAALj9BVl9TeXN0ZW1fZXJyb3JAc3RkQEAAaBENgAEAAAAAAAAAAAAAAC4/QVZydW50aW1lX2Vycm9yQHN0ZEBAAGgRDYABAAAAAAAAAAAAAAAuP0FWYmFkX2FycmF5X25ld19sZW5ndGhAc3RkQEAAAGgRDYABAAAAAAAAAAAAAAAuP0FWYmFkX2FsbG9jQHN0ZEBAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVmV4Y2VwdGlvbkBzdGRAQAAAAAAAAAAAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVjxsYW1iZGFfMT5APzE/Pz8wRnBzVW5sb2NrZXJSZWdpc3RyYXJAP0EweGUxYjRjOTA5QEBRRUFBQFhaQAAAAAAAAAAAAAAAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVjxsYW1iZGFfMT5APzE/Pz8wU2V0RGl0aGVyUmVnaXN0cmFyQD9BMHhlMWI0YzkwOUBAUUVBQUBYWkAAAGgRDYABAAAAAAAAAAAAAAAuP0FWPGxhbWJkYV8xPkA/MT8/PzBOb0NsaXBSZWdpc3RyYXJAP0EweGUxYjRjOTA5QEBRRUFBQFhaQAAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVY8bGFtYmRhXzE+QD8xPz8/MFVuaXR5RXhwbG9yZXJNb2R1bGVSZWdpc3RyYXJAP0EweGUxYjRjOTA5QEBRRUFBQFhaQAAAAAAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVY8bGFtYmRhXzE+QD8xPz8/MEZyZWVDYW1SZWdpc3RyYXJAP0EweGUxYjRjOTA5QEBRRUFBQFhaQAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVjxsYW1iZGFfMT5APzE/Pz8wRVNQTW9kdWxlUmVnaXN0cmFyQD9BMHhlMWI0YzkwOUBAUUVBQUBYWkAAAGgRDYABAAAAAAAAAAAAAAAuP0FWPGxhbWJkYV8xPkA/MT8/PzBWYWN1dW1SZWdpc3RyYXJAP0EweGUxYjRjOTA5QEBRRUFBQFhaQAAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVY8bGFtYmRhXzE+QD8xPz8/MEZQU01vZHVsZVJlZ2lzdHJhckA/QTB4ZTFiNGM5MDlAQFFFQUFAWFpAAABoEQ2AAQAAAAAAAAAAAAAALj9BVjxsYW1iZGFfMT5APzE/Pz8wUGxheWVyUHJvZmlsZVJlZ2lzdHJhckA/QTB4ZTFiNGM5MDlAQFFFQUFAWFpAAAAAAAAAAAAAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVjxsYW1iZGFfMT5APzE/Pz8wU2tpbGxIYWNrUmVnaXN0cmFyQD9BMHhlMWI0YzkwOUBAUUVBQUBYWkAAAGgRDYABAAAAAAAAAAAAAAAuP0FWcmFuZ2VfZXJyb3JAc3RkQEAAAAAAAAAAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWb3RoZXJfZXJyb3JAZGV0YWlsQGpzb25fYWJpX3YzXzEyXzBAbmxvaG1hbm5AQAAAAAAAAAAAAAAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVZleGNlcHRpb25AZGV0YWlsQGpzb25fYWJpX3YzXzEyXzBAbmxvaG1hbm5AQAAAAAAAAAAAAAAAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVmludmFsaWRfaXRlcmF0b3JAZGV0YWlsQGpzb25fYWJpX3YzXzEyXzBAbmxvaG1hbm5AQAAAAAAAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWcGFyc2VfZXJyb3JAZGV0YWlsQGpzb25fYWJpX3YzXzEyXzBAbmxvaG1hbm5AQAAAAAAAAAAAAAAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVZvdXRfb2ZfcmFuZ2VAZGV0YWlsQGpzb25fYWJpX3YzXzEyXzBAbmxvaG1hbm5AQAAAAAAAAAAAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVnR5cGVfZXJyb3JAZGV0YWlsQGpzb25fYWJpX3YzXzEyXzBAbmxvaG1hbm5AQAAAAAAAAAAAAAAAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWdHlwZV9pbmZvQEAAaBENgAEAAAAAAAAAAAAAAC4/QVVfRm10X2J1ZmZlcl90cmFpdHNAc3RkQEAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVY/JF9GbXRfaXRlcmF0b3JfYnVmZmVyQFY/JGJhY2tfaW5zZXJ0X2l0ZXJhdG9yQFY/JGJhc2ljX3N0cmluZ0BEVT8kY2hhcl90cmFpdHNAREBzdGRAQFY/JGFsbG9jYXRvckBEQDJAQHN0ZEBAQHN0ZEBARFVfRm10X2J1ZmZlcl90cmFpdHNAMkBAc3RkQEAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVY/JF9GbXRfYnVmZmVyQERAc3RkQEAAAAAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVY/JG51bXB1bmN0QERAc3RkQEAAAGgRDYABAAAAAAAAAAAAAAAuP0FWZmFjZXRAbG9jYWxlQHN0ZEBAAABoEQ2AAQAAAAAAAAAAAAAALj9BVl9GYWNldF9iYXNlQHN0ZEBAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVVfQ3J0X25ld19kZWxldGVAc3RkQEAAAAAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVZfU3lzdGVtX2Vycm9yX2NhdGVnb3J5QHN0ZEBAAAAAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVl9HZW5lcmljX2Vycm9yX2NhdGVnb3J5QHN0ZEBAAAAAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWZXJyb3JfY2F0ZWdvcnlAc3RkQEAAAAAAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWRVNQTW9kdWxlQEAAaBENgAEAAAAAAAAAAAAAAC4/QVZCYXNlTW9kdWxlQEAAAAAAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWRlBTTW9kdWxlQEAAaBENgAEAAAAAAAAAAAAAAC4/QVZGcHNVbmxvY2tlckBAAAAAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWRnJlZUNhbUBAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVZOb0NsaXBAQAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVlBsYXllclByb2ZpbGVAQAAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVZQcmV2ZW50U2NyZWVuc2hvdEBAAGgRDYABAAAAAAAAAAAAAAAuP0FWU2V0RGl0aGVyQEAAaBENgAEAAAAAAAAAAAAAAC4/QVZTa2lsbEhhY2tAQABoEQ2AAQAAAAAAAAAAAAAALj9BVlVuaXR5RXhwbG9yZXJNb2R1bGVAQAAAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVlZhY3V1bUBAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWPyRfRnVuY19iYXNlQEFFQVZCYXNlTW9kdWxlQEAkJFZAc3RkQEAAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVj8kX0Z1bmNfaW1wbF9ub19hbGxvY0BWPGxhbWJkYV8xPkA/MT8/PzBTZXREaXRoZXJSZWdpc3RyYXJAP0EweGUxYjRjOTA5QEBRRUFBQFhaQEFFQVZCYXNlTW9kdWxlQEAkJFZAc3RkQEAAAGgRDYABAAAAAAAAAAAAAAAuP0FWPyRfRnVuY19pbXBsX25vX2FsbG9jQFY8bGFtYmRhXzE+QD8xPz8/MEZyZWVDYW1SZWdpc3RyYXJAP0EweGUxYjRjOTA5QEBRRUFBQFhaQEFFQVZCYXNlTW9kdWxlQEAkJFZAc3RkQEAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVY/JF9GdW5jX2ltcGxfbm9fYWxsb2NAVjxsYW1iZGFfMT5APzE/Pz8wVW5pdHlFeHBsb3Jlck1vZHVsZVJlZ2lzdHJhckA/QTB4ZTFiNGM5MDlAQFFFQUFAWFpAQUVBVkJhc2VNb2R1bGVAQCQkVkBzdGRAQAAAAAAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVY/JF9GdW5jX2ltcGxfbm9fYWxsb2NAVjxsYW1iZGFfMT5APzE/Pz8wTm9DbGlwUmVnaXN0cmFyQD9BMHhlMWI0YzkwOUBAUUVBQUBYWkBBRUFWQmFzZU1vZHVsZUBAJCRWQHN0ZEBAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVj8kX0Z1bmNfaW1wbF9ub19hbGxvY0BWPGxhbWJkYV8xPkA/MT8/PzBWYWN1dW1SZWdpc3RyYXJAP0EweGUxYjRjOTA5QEBRRUFBQFhaQEFFQVZCYXNlTW9kdWxlQEAkJFZAc3RkQEAAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWPyRfRnVuY19pbXBsX25vX2FsbG9jQFY8bGFtYmRhXzE+QD8xPz8/MFBsYXllclByb2ZpbGVSZWdpc3RyYXJAP0EweGUxYjRjOTA5QEBRRUFBQFhaQEFFQVZCYXNlTW9kdWxlQEAkJFZAc3RkQEAAAAAAAAAAAAAAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWPyRfRnVuY19pbXBsX25vX2FsbG9jQFY8bGFtYmRhXzE+QD8xPz8/MEZwc1VubG9ja2VyUmVnaXN0cmFyQD9BMHhlMWI0YzkwOUBAUUVBQUBYWkBBRUFWQmFzZU1vZHVsZUBAJCRWQHN0ZEBAAAAAAAAAAAAAAAAAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWPyRfRnVuY19pbXBsX25vX2FsbG9jQFY8bGFtYmRhXzE+QD8xPz8/MEZQU01vZHVsZVJlZ2lzdHJhckA/QTB4ZTFiNGM5MDlAQFFFQUFAWFpAQUVBVkJhc2VNb2R1bGVAQCQkVkBzdGRAQAAAaBENgAEAAAAAAAAAAAAAAC4/QVY/JF9GdW5jX2ltcGxfbm9fYWxsb2NAVjxsYW1iZGFfMT5APzE/Pz8wU2tpbGxIYWNrUmVnaXN0cmFyQD9BMHhlMWI0YzkwOUBAUUVBQUBYWkBBRUFWQmFzZU1vZHVsZUBAJCRWQHN0ZEBAAABoEQ2AAQAAAAAAAAAAAAAALj9BVj8kX0Z1bmNfaW1wbF9ub19hbGxvY0BWPGxhbWJkYV8xPkA/MT8/PzBFU1BNb2R1bGVSZWdpc3RyYXJAP0EweGUxYjRjOTA5QEBRRUFBQFhaQEFFQVZCYXNlTW9kdWxlQEAkJFZAc3RkQEAAAGgRDYABAAAAAAAAAAAAAAAuP0FWPyRjb2RlY3Z0X3V0ZjhfdXRmMTZAX1MkMEJBUFBQUEAkMEFAQHN0ZEBAAABoEQ2AAQAAAAAAAAAAAAAALj9BVmNvZGVjdnRfYmFzZUBzdGRAQAAAAAAAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVj8kd3N0cmluZ19jb252ZXJ0QFY/JGNvZGVjdnRfdXRmOF91dGYxNkBfUyQwQkFQUFBQQCQwQUBAc3RkQEBfU1Y/JGFsbG9jYXRvckBfU0AyQFY/JGFsbG9jYXRvckBEQDJAQHN0ZEBAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWPyRjb2RlY3Z0QF9TRFVfTWJzdGF0ZXRAQEBzdGRAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
|