binary-refinery 0.10.9__tar.gz → 0.10.11__tar.gz

{binary_refinery-0.10.9/binary_refinery.egg-info → binary_refinery-0.10.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: binary-refinery
-Version: 0.10.9
+Version: 0.10.11
 Summary: A toolkit to transform and refine (mostly) binary data.
 Home-page: https://github.com/binref/refinery/
 Author: Jesko Huettenhain
@@ -42,72 +42,70 @@ Requires-Dist: pyperclip
 Requires-Dist: pyperclip
 Requires-Dist: colorama
 Provides-Extra: default
+Requires-Dist: pymupdf; extra == "default"
+Requires-Dist: orjson; extra == "default"
 Requires-Dist: capstone; extra == "default"
-Requires-Dist: Pillow; extra == "default"
 Requires-Dist: pikepdf<=9.5; extra == "default"
-Requires-Dist: pefile; extra == "default"
 Requires-Dist: numpy; extra == "default"
-Requires-Dist: orjson; extra == "default"
-Requires-Dist: colorama; extra == "default"
 Requires-Dist: chardet; extra == "default"
-Requires-Dist: pymupdf; extra == "default"
+Requires-Dist: pefile; extra == "default"
+Requires-Dist: colorama; extra == "default"
+Requires-Dist: Pillow; extra == "default"
 Requires-Dist: unicorn>=2.0.1.post1; extra == "default"
 Provides-Extra: extended
-Requires-Dist: pyonenote; extra == "extended"
-Requires-Dist: openpyxl; extra == "extended"
+Requires-Dist: pymupdf; extra == "extended"
+Requires-Dist: orjson; extra == "extended"
+Requires-Dist: capstone; extra == "extended"
+Requires-Dist: python-registry; extra == "extended"
 Requires-Dist: numpy; extra == "extended"
-Requires-Dist: xlrd2; extra == "extended"
+Requires-Dist: openpyxl; extra == "extended"
+Requires-Dist: pyppmd; extra == "extended"
 Requires-Dist: chardet; extra == "extended"
-Requires-Dist: icicle-emu>=0.0.11; extra == "extended"
-Requires-Dist: jsbeautifier; extra == "extended"
-Requires-Dist: python-registry; extra == "extended"
-Requires-Dist: xdis; extra == "extended"
-Requires-Dist: decompyle3; extra == "extended"
+Requires-Dist: uncompyle6>=3.9.3; extra == "extended"
 Requires-Dist: minidump==0.0.24; extra == "extended"
-Requires-Dist: pyppmd; extra == "extended"
+Requires-Dist: xdis; extra == "extended"
 Requires-Dist: colorama; extra == "extended"
-Requires-Dist: uncompyle6>=3.9.3; extra == "extended"
-Requires-Dist: capstone; extra == "extended"
-Requires-Dist: pyxlsb2; extra == "extended"
-Requires-Dist: Pillow; extra == "extended"
+Requires-Dist: unicorn>=2.0.1.post1; extra == "extended"
+Requires-Dist: icicle-emu>=0.0.11; extra == "extended"
+Requires-Dist: xlrd2; extra == "extended"
 Requires-Dist: pikepdf<=9.5; extra == "extended"
+Requires-Dist: pyonenote; extra == "extended"
+Requires-Dist: pyxlsb2; extra == "extended"
 Requires-Dist: pefile; extra == "extended"
-Requires-Dist: orjson; extra == "extended"
-Requires-Dist: pyzstd; extra == "extended"
+Requires-Dist: Pillow; extra == "extended"
 Requires-Dist: brotli; extra == "extended"
-Requires-Dist: pymupdf; extra == "extended"
-Requires-Dist: unicorn>=2.0.1.post1; extra == "extended"
+Requires-Dist: decompyle3; extra == "extended"
+Requires-Dist: pyzstd; extra == "extended"
 Provides-Extra: all
-Requires-Dist: pyonenote; extra == "all"
-Requires-Dist: openpyxl; extra == "all"
+Requires-Dist: pymupdf; extra == "all"
+Requires-Dist: orjson; extra == "all"
+Requires-Dist: capstone; extra == "all"
+Requires-Dist: python-registry; extra == "all"
 Requires-Dist: numpy; extra == "all"
-Requires-Dist: xlrd2; extra == "all"
+Requires-Dist: openpyxl; extra == "all"
+Requires-Dist: pyppmd; extra == "all"
+Requires-Dist: smda<2.0; extra == "all"
+Requires-Dist: javaobj-py3>=0.4.0.1; extra == "all"
 Requires-Dist: python-evtx; extra == "all"
+Requires-Dist: python-idb<=0.8.0; extra == "all"
 Requires-Dist: chardet; extra == "all"
-Requires-Dist: icicle-emu>=0.0.11; extra == "all"
-Requires-Dist: jsbeautifier; extra == "all"
-Requires-Dist: python-registry; extra == "all"
-Requires-Dist: javaobj-py3>=0.4.0.1; extra == "all"
-Requires-Dist: xdis; extra == "all"
-Requires-Dist: decompyle3; extra == "all"
-Requires-Dist: smda<2.0; extra == "all"
+Requires-Dist: uncompyle6>=3.9.3; extra == "all"
+Requires-Dist: Pygments; extra == "all"
 Requires-Dist: minidump==0.0.24; extra == "all"
-Requires-Dist: pyppmd; extra == "all"
+Requires-Dist: xdis; extra == "all"
 Requires-Dist: colorama; extra == "all"
-Requires-Dist: python-idb<=0.8.0; extra == "all"
-Requires-Dist: Pygments; extra == "all"
-Requires-Dist: uncompyle6>=3.9.3; extra == "all"
-Requires-Dist: capstone; extra == "all"
-Requires-Dist: speakeasy-emulator-refined==1.6.1b0.post3; extra == "all"
-Requires-Dist: pyxlsb2; extra == "all"
-Requires-Dist: Pillow; extra == "all"
+Requires-Dist: unicorn>=2.0.1.post1; extra == "all"
+Requires-Dist: icicle-emu>=0.0.11; extra == "all"
+Requires-Dist: xlrd2; extra == "all"
 Requires-Dist: pikepdf<=9.5; extra == "all"
+Requires-Dist: pyonenote; extra == "all"
+Requires-Dist: pyxlsb2; extra == "all"
 Requires-Dist: pefile; extra == "all"
-Requires-Dist: orjson; extra == "all"
-Requires-Dist: pyzstd; extra == "all"
+Requires-Dist: speakeasy-emulator-refined==1.6.1b0.post3; extra == "all"
+Requires-Dist: Pillow; extra == "all"
 Requires-Dist: brotli; extra == "all"
-Requires-Dist: pymupdf; extra == "all"
-Requires-Dist: unicorn>=2.0.1.post1; extra == "all"
+Requires-Dist: decompyle3; extra == "all"
+Requires-Dist: pyzstd; extra == "all"
 Dynamic: author
 Dynamic: classifier
 Dynamic: description
@@ -396,14 +394,11 @@ emit 81a1fca7a1fb97fe021a1f2cf0bf9011dd2e72a5864aad674f8fea4ef009417b [ \
   | xlxtr 9.5:11.5 15.15 12.5:14.5 [ \
   | scope -n 3 | chop -t 5 [| sorted -a | snip 2: | sep ] \
   | pack 10 | alu --dec -sN B-S ]] \
-  | dump payload.ps1
+  | dump payload.cmd
 ```
 And get the domains for the next stage:
 ```
-emit payload.ps1 
-  | carve -sd b64 | zl | deob-ps1 
-  | carve -sd b64 | zl | deob-ps1
-  | xtp -f domain
+emit payload.cmd | cmdarg | ps1 | xtp -f domain
 ```
 Extract the configuration of unpacked HawkEye samples:
 ```
@@ -421,7 +416,7 @@ emit 4537fab9de768a668ab4e72ae2cce3169b7af2dd36a1723ddab09c04d31d61a5 \
 Extract payload from a shellcode loader and carve its c2:
 ```
 emit 58ba30052d249805caae0107a0e2a5a3cb85f3000ba5479fafb7767e2a5a78f3 \
-  | rex yara:50607080.* [| struct LL{s:L}{} | xor -B2 accu[s]:@msvc | xtp url ]
+  | rex yara:50607080.* [| struct LL{s:L}{} | xor -B2 rand[s]:msvc | xtp url ]
 ```
 Get the malicious VBA macros from a forgotten time when this was how it was done:
 ```

{binary_refinery-0.10.9 → binary_refinery-0.10.11}/README.md

@@ -275,14 +275,11 @@ emit 81a1fca7a1fb97fe021a1f2cf0bf9011dd2e72a5864aad674f8fea4ef009417b [ \
   | xlxtr 9.5:11.5 15.15 12.5:14.5 [ \
   | scope -n 3 | chop -t 5 [| sorted -a | snip 2: | sep ] \
   | pack 10 | alu --dec -sN B-S ]] \
-  | dump payload.ps1
+  | dump payload.cmd
 ```
 And get the domains for the next stage:
 ```
-emit payload.ps1 
-  | carve -sd b64 | zl | deob-ps1 
-  | carve -sd b64 | zl | deob-ps1
-  | xtp -f domain
+emit payload.cmd | cmdarg | ps1 | xtp -f domain
 ```
 Extract the configuration of unpacked HawkEye samples:
 ```
@@ -300,7 +297,7 @@ emit 4537fab9de768a668ab4e72ae2cce3169b7af2dd36a1723ddab09c04d31d61a5 \
 Extract payload from a shellcode loader and carve its c2:
 ```
 emit 58ba30052d249805caae0107a0e2a5a3cb85f3000ba5479fafb7767e2a5a78f3 \
-  | rex yara:50607080.* [| struct LL{s:L}{} | xor -B2 accu[s]:@msvc | xtp url ]
+  | rex yara:50607080.* [| struct LL{s:L}{} | xor -B2 rand[s]:msvc | xtp url ]
 ```
 Get the malicious VBA macros from a forgotten time when this was how it was done:
 ```

{binary_refinery-0.10.9 → binary_refinery-0.10.11/binary_refinery.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: binary-refinery
-Version: 0.10.9
+Version: 0.10.11
 Summary: A toolkit to transform and refine (mostly) binary data.
 Home-page: https://github.com/binref/refinery/
 Author: Jesko Huettenhain
@@ -42,72 +42,70 @@ Requires-Dist: pyperclip
 Requires-Dist: pyperclip
 Requires-Dist: colorama
 Provides-Extra: default
+Requires-Dist: pymupdf; extra == "default"
+Requires-Dist: orjson; extra == "default"
 Requires-Dist: capstone; extra == "default"
-Requires-Dist: Pillow; extra == "default"
 Requires-Dist: pikepdf<=9.5; extra == "default"
-Requires-Dist: pefile; extra == "default"
 Requires-Dist: numpy; extra == "default"
-Requires-Dist: orjson; extra == "default"
-Requires-Dist: colorama; extra == "default"
 Requires-Dist: chardet; extra == "default"
-Requires-Dist: pymupdf; extra == "default"
+Requires-Dist: pefile; extra == "default"
+Requires-Dist: colorama; extra == "default"
+Requires-Dist: Pillow; extra == "default"
 Requires-Dist: unicorn>=2.0.1.post1; extra == "default"
 Provides-Extra: extended
-Requires-Dist: pyonenote; extra == "extended"
-Requires-Dist: openpyxl; extra == "extended"
+Requires-Dist: pymupdf; extra == "extended"
+Requires-Dist: orjson; extra == "extended"
+Requires-Dist: capstone; extra == "extended"
+Requires-Dist: python-registry; extra == "extended"
 Requires-Dist: numpy; extra == "extended"
-Requires-Dist: xlrd2; extra == "extended"
+Requires-Dist: openpyxl; extra == "extended"
+Requires-Dist: pyppmd; extra == "extended"
 Requires-Dist: chardet; extra == "extended"
-Requires-Dist: icicle-emu>=0.0.11; extra == "extended"
-Requires-Dist: jsbeautifier; extra == "extended"
-Requires-Dist: python-registry; extra == "extended"
-Requires-Dist: xdis; extra == "extended"
-Requires-Dist: decompyle3; extra == "extended"
+Requires-Dist: uncompyle6>=3.9.3; extra == "extended"
 Requires-Dist: minidump==0.0.24; extra == "extended"
-Requires-Dist: pyppmd; extra == "extended"
+Requires-Dist: xdis; extra == "extended"
 Requires-Dist: colorama; extra == "extended"
-Requires-Dist: uncompyle6>=3.9.3; extra == "extended"
-Requires-Dist: capstone; extra == "extended"
-Requires-Dist: pyxlsb2; extra == "extended"
-Requires-Dist: Pillow; extra == "extended"
+Requires-Dist: unicorn>=2.0.1.post1; extra == "extended"
+Requires-Dist: icicle-emu>=0.0.11; extra == "extended"
+Requires-Dist: xlrd2; extra == "extended"
 Requires-Dist: pikepdf<=9.5; extra == "extended"
+Requires-Dist: pyonenote; extra == "extended"
+Requires-Dist: pyxlsb2; extra == "extended"
 Requires-Dist: pefile; extra == "extended"
-Requires-Dist: orjson; extra == "extended"
-Requires-Dist: pyzstd; extra == "extended"
+Requires-Dist: Pillow; extra == "extended"
 Requires-Dist: brotli; extra == "extended"
-Requires-Dist: pymupdf; extra == "extended"
-Requires-Dist: unicorn>=2.0.1.post1; extra == "extended"
+Requires-Dist: decompyle3; extra == "extended"
+Requires-Dist: pyzstd; extra == "extended"
 Provides-Extra: all
-Requires-Dist: pyonenote; extra == "all"
-Requires-Dist: openpyxl; extra == "all"
+Requires-Dist: pymupdf; extra == "all"
+Requires-Dist: orjson; extra == "all"
+Requires-Dist: capstone; extra == "all"
+Requires-Dist: python-registry; extra == "all"
 Requires-Dist: numpy; extra == "all"
-Requires-Dist: xlrd2; extra == "all"
+Requires-Dist: openpyxl; extra == "all"
+Requires-Dist: pyppmd; extra == "all"
+Requires-Dist: smda<2.0; extra == "all"
+Requires-Dist: javaobj-py3>=0.4.0.1; extra == "all"
 Requires-Dist: python-evtx; extra == "all"
+Requires-Dist: python-idb<=0.8.0; extra == "all"
 Requires-Dist: chardet; extra == "all"
-Requires-Dist: icicle-emu>=0.0.11; extra == "all"
-Requires-Dist: jsbeautifier; extra == "all"
-Requires-Dist: python-registry; extra == "all"
-Requires-Dist: javaobj-py3>=0.4.0.1; extra == "all"
-Requires-Dist: xdis; extra == "all"
-Requires-Dist: decompyle3; extra == "all"
-Requires-Dist: smda<2.0; extra == "all"
+Requires-Dist: uncompyle6>=3.9.3; extra == "all"
+Requires-Dist: Pygments; extra == "all"
 Requires-Dist: minidump==0.0.24; extra == "all"
-Requires-Dist: pyppmd; extra == "all"
+Requires-Dist: xdis; extra == "all"
 Requires-Dist: colorama; extra == "all"
-Requires-Dist: python-idb<=0.8.0; extra == "all"
-Requires-Dist: Pygments; extra == "all"
-Requires-Dist: uncompyle6>=3.9.3; extra == "all"
-Requires-Dist: capstone; extra == "all"
-Requires-Dist: speakeasy-emulator-refined==1.6.1b0.post3; extra == "all"
-Requires-Dist: pyxlsb2; extra == "all"
-Requires-Dist: Pillow; extra == "all"
+Requires-Dist: unicorn>=2.0.1.post1; extra == "all"
+Requires-Dist: icicle-emu>=0.0.11; extra == "all"
+Requires-Dist: xlrd2; extra == "all"
 Requires-Dist: pikepdf<=9.5; extra == "all"
+Requires-Dist: pyonenote; extra == "all"
+Requires-Dist: pyxlsb2; extra == "all"
 Requires-Dist: pefile; extra == "all"
-Requires-Dist: orjson; extra == "all"
-Requires-Dist: pyzstd; extra == "all"
+Requires-Dist: speakeasy-emulator-refined==1.6.1b0.post3; extra == "all"
+Requires-Dist: Pillow; extra == "all"
 Requires-Dist: brotli; extra == "all"
-Requires-Dist: pymupdf; extra == "all"
-Requires-Dist: unicorn>=2.0.1.post1; extra == "all"
+Requires-Dist: decompyle3; extra == "all"
+Requires-Dist: pyzstd; extra == "all"
 Dynamic: author
 Dynamic: classifier
 Dynamic: description
@@ -396,14 +394,11 @@ emit 81a1fca7a1fb97fe021a1f2cf0bf9011dd2e72a5864aad674f8fea4ef009417b [ \
   | xlxtr 9.5:11.5 15.15 12.5:14.5 [ \
   | scope -n 3 | chop -t 5 [| sorted -a | snip 2: | sep ] \
   | pack 10 | alu --dec -sN B-S ]] \
-  | dump payload.ps1
+  | dump payload.cmd
 ```
 And get the domains for the next stage:
 ```
-emit payload.ps1 
-  | carve -sd b64 | zl | deob-ps1 
-  | carve -sd b64 | zl | deob-ps1
-  | xtp -f domain
+emit payload.cmd | cmdarg | ps1 | xtp -f domain
 ```
 Extract the configuration of unpacked HawkEye samples:
 ```
@@ -421,7 +416,7 @@ emit 4537fab9de768a668ab4e72ae2cce3169b7af2dd36a1723ddab09c04d31d61a5 \
 Extract payload from a shellcode loader and carve its c2:
 ```
 emit 58ba30052d249805caae0107a0e2a5a3cb85f3000ba5479fafb7767e2a5a78f3 \
-  | rex yara:50607080.* [| struct LL{s:L}{} | xor -B2 accu[s]:@msvc | xtp url ]
+  | rex yara:50607080.* [| struct LL{s:L}{} | xor -B2 rand[s]:msvc | xtp url ]
 ```
 Get the malicious VBA macros from a forgotten time when this was how it was done:
 ```

{binary_refinery-0.10.9 → binary_refinery-0.10.11}/binary_refinery.egg-info/SOURCES.txt

@@ -11,6 +11,8 @@ binary_refinery.egg-info/entry_points.txt
 binary_refinery.egg-info/requires.txt
 binary_refinery.egg-info/top_level.txt
 refinery/__init__.py
+refinery/__init__.pyi
+refinery/__unit__.py
 refinery/explore.py
 refinery/shell.py
 refinery/data/__init__.py
@@ -69,16 +71,6 @@ refinery/lib/asn1/compiler.py
 refinery/lib/asn1/defs.py
 refinery/lib/asn1/reader.py
 refinery/lib/asn1/schema.py
-refinery/lib/batch/__init__.py
-refinery/lib/batch/const.py
-refinery/lib/batch/emulator.py
-refinery/lib/batch/help.py
-refinery/lib/batch/lexer.py
-refinery/lib/batch/model.py
-refinery/lib/batch/parser.py
-refinery/lib/batch/state.py
-refinery/lib/batch/synth.py
-refinery/lib/batch/util.py
 refinery/lib/crypto/__init__.py
 refinery/lib/crypto/aria.py
 refinery/lib/crypto/maru.py
@@ -112,16 +104,31 @@ refinery/lib/fast/__init__.py
 refinery/lib/fast/a3x.c
 refinery/lib/fast/a3x.py
 refinery/lib/fast/a3x.pyx
+refinery/lib/fast/aplib.c
+refinery/lib/fast/aplib.py
+refinery/lib/fast/aplib.pyx
 refinery/lib/fast/argon2.c
 refinery/lib/fast/argon2.py
 refinery/lib/fast/argon2.pyx
+refinery/lib/fast/blz.c
+refinery/lib/fast/blz.py
+refinery/lib/fast/blz.pyx
 refinery/lib/fast/lzfse.c
 refinery/lib/fast/lzfse.py
 refinery/lib/fast/lzfse.pyx
+refinery/lib/fast/lzjb.c
+refinery/lib/fast/lzjb.py
+refinery/lib/fast/lzjb.pyx
+refinery/lib/fast/lzw.c
+refinery/lib/fast/lzw.py
+refinery/lib/fast/lzw.pyx
 refinery/lib/fast/pkware.c
 refinery/lib/fast/pkware.py
 refinery/lib/fast/pkware.pyx
 refinery/lib/fast/pkware_tables.py
+refinery/lib/fast/xpress.c
+refinery/lib/fast/xpress.py
+refinery/lib/fast/xpress.pyx
 refinery/lib/fast/zipcrypto.c
 refinery/lib/fast/zipcrypto.py
 refinery/lib/fast/zipcrypto.pyx
@@ -141,6 +148,10 @@ refinery/lib/lnk/header.py
 refinery/lib/lnk/idlist.py
 refinery/lib/lnk/linkinfo.py
 refinery/lib/lnk/stringdata.py
+refinery/lib/nsis/__init__.py
+refinery/lib/nsis/archive.py
+refinery/lib/nsis/controlflow.py
+refinery/lib/nsis/decompiler.py
 refinery/lib/ole/__init__.py
 refinery/lib/ole/crypto.py
 refinery/lib/ole/decompiler.py
@@ -156,6 +167,66 @@ refinery/lib/qr/correct.py
 refinery/lib/qr/decode.py
 refinery/lib/qr/locate.py
 refinery/lib/qr/tables.py
+refinery/lib/scripts/__init__.py
+refinery/lib/scripts/guess.py
+refinery/lib/scripts/pipeline.py
+refinery/lib/scripts/win32const.py
+refinery/lib/scripts/bat/__init__.py
+refinery/lib/scripts/bat/const.py
+refinery/lib/scripts/bat/emulator.py
+refinery/lib/scripts/bat/help.py
+refinery/lib/scripts/bat/lexer.py
+refinery/lib/scripts/bat/model.py
+refinery/lib/scripts/bat/parser.py
+refinery/lib/scripts/bat/state.py
+refinery/lib/scripts/bat/synth.py
+refinery/lib/scripts/bat/util.py
+refinery/lib/scripts/js/__init__.py
+refinery/lib/scripts/js/lexer.py
+refinery/lib/scripts/js/model.py
+refinery/lib/scripts/js/parser.py
+refinery/lib/scripts/js/synth.py
+refinery/lib/scripts/js/token.py
+refinery/lib/scripts/js/deobfuscation/__init__.py
+refinery/lib/scripts/js/deobfuscation/helpers.py
+refinery/lib/scripts/js/deobfuscation/simplify.py
+refinery/lib/scripts/ps1/__init__.py
+refinery/lib/scripts/ps1/lexer.py
+refinery/lib/scripts/ps1/model.py
+refinery/lib/scripts/ps1/parser.py
+refinery/lib/scripts/ps1/synth.py
+refinery/lib/scripts/ps1/token.py
+refinery/lib/scripts/ps1/deobfuscation/__init__.py
+refinery/lib/scripts/ps1/deobfuscation/aliases.py
+refinery/lib/scripts/ps1/deobfuscation/constants.py
+refinery/lib/scripts/ps1/deobfuscation/deadcode.py
+refinery/lib/scripts/ps1/deobfuscation/emulator.py
+refinery/lib/scripts/ps1/deobfuscation/expandable.py
+refinery/lib/scripts/ps1/deobfuscation/folding.py
+refinery/lib/scripts/ps1/deobfuscation/helpers.py
+refinery/lib/scripts/ps1/deobfuscation/iexinline.py
+refinery/lib/scripts/ps1/deobfuscation/names.py
+refinery/lib/scripts/ps1/deobfuscation/securestring.py
+refinery/lib/scripts/ps1/deobfuscation/simplify.py
+refinery/lib/scripts/ps1/deobfuscation/typecast.py
+refinery/lib/scripts/ps1/deobfuscation/typenames.py
+refinery/lib/scripts/ps1/deobfuscation/unflatten.py
+refinery/lib/scripts/ps1/deobfuscation/unused.py
+refinery/lib/scripts/ps1/deobfuscation/wildcards.py
+refinery/lib/scripts/vba/__init__.py
+refinery/lib/scripts/vba/lexer.py
+refinery/lib/scripts/vba/model.py
+refinery/lib/scripts/vba/parser.py
+refinery/lib/scripts/vba/synth.py
+refinery/lib/scripts/vba/token.py
+refinery/lib/scripts/vba/deobfuscation/__init__.py
+refinery/lib/scripts/vba/deobfuscation/builtins.py
+refinery/lib/scripts/vba/deobfuscation/constants.py
+refinery/lib/scripts/vba/deobfuscation/deadcode.py
+refinery/lib/scripts/vba/deobfuscation/emulator.py
+refinery/lib/scripts/vba/deobfuscation/helpers.py
+refinery/lib/scripts/vba/deobfuscation/names.py
+refinery/lib/scripts/vba/deobfuscation/simplify.py
 refinery/lib/seven/__init__.py
 refinery/lib/seven/deflate.c
 refinery/lib/seven/deflate.py
@@ -196,6 +267,7 @@ refinery/lib/un7z/headers.py
 refinery/lib/unrar/__init__.py
 refinery/lib/unrar/crc.py
 refinery/lib/unrar/crypt.py
+refinery/lib/unrar/filters.c
 refinery/lib/unrar/filters.py
 refinery/lib/unrar/headers.py
 refinery/lib/unrar/reader.py
@@ -203,6 +275,7 @@ refinery/lib/unrar/unpack.py
 refinery/lib/unrar/unpack15.py
 refinery/lib/unrar/unpack20.py
 refinery/lib/unrar/unpack30.py
+refinery/lib/unrar/unpack50.c
 refinery/lib/unrar/unpack50.py
 refinery/units/__init__.py
 refinery/units/blockwise/__init__.py
@@ -322,6 +395,7 @@ refinery/units/encoding/b65536.py
 refinery/units/encoding/b85.py
 refinery/units/encoding/b92.py
 refinery/units/encoding/base.py
+refinery/units/encoding/bigint.py
 refinery/units/encoding/cp1252.py
 refinery/units/encoding/esc.py
 refinery/units/encoding/escps.py
@@ -342,7 +416,6 @@ refinery/units/formats/__init__.py
 refinery/units/formats/a3x.py
 refinery/units/formats/a3xs.py
 refinery/units/formats/asn1.py
-refinery/units/formats/bat.py
 refinery/units/formats/cbor.py
 refinery/units/formats/csv.py
 refinery/units/formats/deserialize_php.py
@@ -380,6 +453,7 @@ refinery/units/formats/pymstr.py
 refinery/units/formats/qr.py
 refinery/units/formats/sqlite.py
 refinery/units/formats/stego.py
+refinery/units/formats/swf.py
 refinery/units/formats/winreg.py
 refinery/units/formats/xml.py
 refinery/units/formats/archive/__init__.py
@@ -506,40 +580,6 @@ refinery/units/misc/run.py
 refinery/units/misc/unq.py
 refinery/units/misc/urlfix.py
 refinery/units/misc/xkey.py
-refinery/units/obfuscation/__init__.py
-refinery/units/obfuscation/js/__init__.py
-refinery/units/obfuscation/js/arithmetic.py
-refinery/units/obfuscation/js/arrays.py
-refinery/units/obfuscation/js/comments.py
-refinery/units/obfuscation/js/concat.py
-refinery/units/obfuscation/js/getattr.py
-refinery/units/obfuscation/js/tuples.py
-refinery/units/obfuscation/ps1/__init__.py
-refinery/units/obfuscation/ps1/all.py
-refinery/units/obfuscation/ps1/b64convert.py
-refinery/units/obfuscation/ps1/brackets.py
-refinery/units/obfuscation/ps1/cases.py
-refinery/units/obfuscation/ps1/concat.py
-refinery/units/obfuscation/ps1/encodings.py
-refinery/units/obfuscation/ps1/escape.py
-refinery/units/obfuscation/ps1/format.py
-refinery/units/obfuscation/ps1/invoke.py
-refinery/units/obfuscation/ps1/securestring.py
-refinery/units/obfuscation/ps1/stringreplace.py
-refinery/units/obfuscation/ps1/typecast.py
-refinery/units/obfuscation/ps1/uncurly.py
-refinery/units/obfuscation/vba/__init__.py
-refinery/units/obfuscation/vba/all.py
-refinery/units/obfuscation/vba/arithmetic.py
-refinery/units/obfuscation/vba/brackets.py
-refinery/units/obfuscation/vba/char.py
-refinery/units/obfuscation/vba/comments.py
-refinery/units/obfuscation/vba/concat.py
-refinery/units/obfuscation/vba/constants.py
-refinery/units/obfuscation/vba/dummies.py
-refinery/units/obfuscation/vba/stringreplace.py
-refinery/units/obfuscation/vba/stringreverse.py
-refinery/units/obfuscation/vba/vba.py
 refinery/units/pattern/__init__.py
 refinery/units/pattern/carve.py
 refinery/units/pattern/carve_7z.py
@@ -565,6 +605,13 @@ refinery/units/pattern/subfiles.py
 refinery/units/pattern/urlguards.py
 refinery/units/pattern/xtp.py
 refinery/units/pattern/xtw.py
+refinery/units/scripting/__init__.py
+refinery/units/scripting/bat.py
+refinery/units/scripting/cmdarg.py
+refinery/units/scripting/deobfuscate.py
+refinery/units/scripting/js.py
+refinery/units/scripting/ps1.py
+refinery/units/scripting/vba.py
 refinery/units/sinks/__init__.py
 refinery/units/sinks/asm.py
 refinery/units/sinks/dnasm.py

{binary_refinery-0.10.9 → binary_refinery-0.10.11}/binary_refinery.egg-info/entry_points.txt

@@ -22,7 +22,8 @@ b65536 = refinery.units.encoding.b65536:b65536.run
 b85 = refinery.units.encoding.b85:b85.run
 b92 = refinery.units.encoding.b92:b92.run
 base = refinery.units.encoding.base:base.run
-bat = refinery.units.formats.bat:bat.run
+bat = refinery.units.scripting.bat:bat.run
+bigint = refinery.units.encoding.bigint:bigint.run
 binref = refinery.explore:explorer
 bitrev = refinery.units.blockwise.bitrev:bitrev.run
 bitsnip = refinery.units.blockwise.bitsnip:bitsnip.run
@@ -60,6 +61,7 @@ chaskey = refinery.units.crypto.cipher.chaskey:chaskey.run
 chop = refinery.units.meta.chop:chop.run
 clower = refinery.units.strings.clower:clower.run
 cm = refinery.units.meta.cm:cm.run
+cmdarg = refinery.units.scripting.cmdarg:cmdarg.run
 codebook = refinery.units.crypto.cipher.codebook:codebook.run
 cp1252 = refinery.units.encoding.cp1252:cp1252.run
 crc32 = refinery.units.crypto.hash.checksums:crc32.run
@@ -73,36 +75,7 @@ datefix = refinery.units.misc.datefix:datefix.run
 decompress = refinery.units.compression.decompress:decompress.run
 dedup = refinery.units.meta.dedup:dedup.run
 defang = refinery.units.pattern.defang:defang.run
-deob-js-arithmetic = refinery.units.obfuscation.js.arithmetic:deob_js_arithmetic.run
-deob-js-arrays = refinery.units.obfuscation.js.arrays:deob_js_arrays.run
-deob-js-comments = refinery.units.obfuscation.js.comments:deob_js_comments.run
-deob-js-concat = refinery.units.obfuscation.js.concat:deob_js_concat.run
-deob-js-getattr = refinery.units.obfuscation.js.getattr:deob_js_getattr.run
-deob-js-tuples = refinery.units.obfuscation.js.tuples:deob_js_tuples.run
-deob-ps1 = refinery.units.obfuscation.ps1.all:deob_ps1.run
-deob-ps1-b64convert = refinery.units.obfuscation.ps1.b64convert:deob_ps1_b64convert.run
-deob-ps1-brackets = refinery.units.obfuscation.ps1.brackets:deob_ps1_brackets.run
-deob-ps1-cases = refinery.units.obfuscation.ps1.cases:deob_ps1_cases.run
-deob-ps1-concat = refinery.units.obfuscation.ps1.concat:deob_ps1_concat.run
-deob-ps1-encodings = refinery.units.obfuscation.ps1.encodings:deob_ps1_encodings.run
-deob-ps1-escape = refinery.units.obfuscation.ps1.escape:deob_ps1_escape.run
-deob-ps1-format = refinery.units.obfuscation.ps1.format:deob_ps1_format.run
-deob-ps1-invoke = refinery.units.obfuscation.ps1.invoke:deob_ps1_invoke.run
-deob-ps1-secstr = refinery.units.obfuscation.ps1.securestring:deob_ps1_secstr.run
-deob-ps1-stringreplace = refinery.units.obfuscation.ps1.stringreplace:deob_ps1_stringreplace.run
-deob-ps1-typecast = refinery.units.obfuscation.ps1.typecast:deob_ps1_typecast.run
-deob-ps1-uncurly = refinery.units.obfuscation.ps1.uncurly:deob_ps1_uncurly.run
-deob-vba = refinery.units.obfuscation.vba.all:deob_vba.run
-deob-vba-arithmetic = refinery.units.obfuscation.vba.arithmetic:deob_vba_arithmetic.run
-deob-vba-brackets = refinery.units.obfuscation.vba.brackets:deob_vba_brackets.run
-deob-vba-char-function = refinery.units.obfuscation.vba.char:deob_vba_char_function.run
-deob-vba-chr-literals = refinery.units.obfuscation.vba.vba:deob_vba_chr_literals.run
-deob-vba-comments = refinery.units.obfuscation.vba.comments:deob_vba_comments.run
-deob-vba-concat = refinery.units.obfuscation.vba.concat:deob_vba_concat.run
-deob-vba-constants = refinery.units.obfuscation.vba.constants:deob_vba_constants.run
-deob-vba-dummy-variables = refinery.units.obfuscation.vba.dummies:deob_vba_dummy_variables.run
-deob-vba-stringreplace = refinery.units.obfuscation.vba.stringreplace:deob_vba_stringreplace.run
-deob-vba-stringreverse = refinery.units.obfuscation.vba.stringreverse:deob_vba_stringreverse.run
+defu = refinery.units.scripting.deobfuscate:defu.run
 des = refinery.units.crypto.cipher.des:des.run
 des3 = refinery.units.crypto.cipher.des3:des3.run
 deskd = refinery.units.crypto.keyderive.deskd:deskd.run
@@ -176,6 +149,7 @@ isaac = refinery.units.crypto.cipher.isaac:isaac.run
 jamv = refinery.units.meta.jamv:jamv.run
 jcalg = refinery.units.compression.jcalg:jcalg.run
 jpeg = refinery.units.formats.jpeg:jpeg.run
+js = refinery.units.scripting.js:js.run
 jvdasm = refinery.units.formats.java.jvdasm:jvdasm.run
 jvstr = refinery.units.formats.java.jvstr:jvstr.run
 kblob = refinery.units.crypto.keyderive.kblob:kblob.run
@@ -257,6 +231,7 @@ pop = refinery.units.meta.pop:pop.run
 ppjscript = refinery.units.sinks.ppjscript:ppjscript.run
 ppjson = refinery.units.sinks.ppjson:ppjson.run
 ppxml = refinery.units.sinks.ppxml:ppxml.run
+ps1 = refinery.units.scripting.ps1:ps1.run
 puny = refinery.units.encoding.puny:puny.run
 push = refinery.units.meta.push:push.run
 put = refinery.units.meta.put:put.run
@@ -296,6 +271,8 @@ rtfc = refinery.units.formats.office.rtfc:rtfc.run
 run = refinery.units.misc.run:run.run
 salsa = refinery.units.crypto.cipher.salsa:salsa.run
 salsa20 = refinery.units.crypto.cipher.salsa:salsa20.run
+sbc = refinery.units.meta.sep:sbc.run
+sbs = refinery.units.meta.sep:sbs.run
 scope = refinery.units.meta.scope:scope.run
 scrypt = refinery.units.crypto.keyderive.scrypt:scrypt.run
 seal = refinery.units.crypto.cipher.seal:seal.run
@@ -329,6 +306,7 @@ struct = refinery.units.pattern.struct_parser:struct.run
 sub = refinery.units.blockwise.sub:sub.run
 subfiles = refinery.units.pattern.subfiles:subfiles.run
 swap = refinery.units.meta.swap:swap.run
+swf = refinery.units.formats.swf:swf.run
 szdd = refinery.units.compression.szdd:szdd.run
 tea = refinery.units.crypto.cipher.tea:tea.run
 termfit = refinery.units.strings.termfit:termfit.run
@@ -345,6 +323,7 @@ urlguards = refinery.units.pattern.urlguards:urlguards.run
 urn = refinery.units.meta.urn:urn.run
 uuenc = refinery.units.encoding.uuenc:uuenc.run
 vaddr = refinery.units.formats.exe.vaddr:vaddr.run
+vba = refinery.units.scripting.vba:vba.run
 vbamc = refinery.units.formats.office.vbamc:vbamc.run
 vbapc = refinery.units.formats.office.vbapc:vbapc.run
 vbastr = refinery.units.formats.office.vbastr:vbastr.run