[m0w0kuma]

I've been working on something similar [1], but I took a different approach: I statically extract all decryption stubs using a IDA script I wrote, then emulate them using Unicorn. I'm also interested in your implementation details—do you have your code on GitHub or somewhere else?

[1] https://github.com/m0w0kuma/ROFL

[maknee]

That's pretty cool! It's quite similar to my tool in many ways. Parsing the file, setting up the packet context and using unicorn :)

The repo isn't on github. I might release it later, but I would want it to be in a better shape if I were to.