ydkhatri / OneDrive

OneDrive log .ODL reader
https://swiftforensics.com
MIT License
109 stars 24 forks source link

decrypted_word always returned something #10

Open Beercow opened 2 months ago

Beercow commented 2 months ago

Removed cipher_text_orig from decrypt(). This broke decryption of older versions that relied on ObfuscationStringMap.txt because decrypted_word always returned something causing the map to not be checked.

   for part in parts:
        if part[1] == 0: # token
            output += part[0]
        else: # word
            word = part[0]
            decrypted_word = decrypt(word)
            if decrypted_word:  # was always true because it would return the original word
                output += decrypted_word
            elif word in map:  # This statement would never be called
                output += map[word]
            else:
                output += word