A tool that uses known-plaintext attacks to decrypt XOR-encoded files by deducing the original keystream.
unXOR is a cryptographic analysis tool that decrypts XOR-encoded files using known-plaintext attacks. It searches through XOR-encrypted data and deduces the original keystream when a portion of the plaintext is known, enabling recovery of encrypted content without the encryption key.
Security researchers, forensic analysts, reverse engineers, and malware analysts who need to decrypt XOR-encrypted files during investigations or security assessments.
Developers choose unXOR for its efficient linear complexity algorithm, support for multiple implementation formats (Golang, Python, Docker), and inclusion in established security tool distributions like REMnux, making it a trusted solution for XOR decryption tasks.
unXOR will search a XORed file and try to guess the key using known-plaintext attacks.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Operates with computational complexity that scales linearly with input size, making it fast and suitable for large files without significant performance degradation, as highlighted in the README.
Available as Golang binary, Docker container, and Python script, offering flexibility for different deployment environments and ease of integration into existing toolchains.
Included in Lenny Zeltser's REMnux distribution, which lends credibility and ensures it's vetted and trusted within the security research and forensic analysis communities.
Processes XOR-encoded files regardless of content type, handling both binary and text data, which is essential for real-world forensic and malware analysis scenarios.
Relies on having a known portion of the plaintext to deduce the keystream, limiting its use in cases where such information is unavailable or hard to obtain.
Only works on keys up to half the length of the known plaintext, which can be restrictive when dealing with short known texts or very long keys, reducing its effectiveness in some attacks.
The README provides basic usage examples but lacks detailed tutorials or error handling guides, and it offers no graphical interface, which may hinder less technical users or rapid prototyping.