javieryuste/avaddondecryptor

A decryptor for systems infected by Avaddon ransomware.

avaddondecryptor's Issues

Question on the published paper

Hello,

I had a question regarding function addresses mentioned in the paper. On page 9, there are two statements:

1. The function responsible of generating the session key is the one located at 0x413f50
2. Finally, the function located at 0x413f50 is the one responsible for securely destroying the keys.

On page 11, this statement: However, we also hinted that the function responsible for destroying the cryptographic material was in fact never called if the system was not powered off.

I don't understand. If function at 0x413f50 was used to generate the session key then it was surely called. Is the address of the function that is used to destroy the session keys mentioned wrong in the paper?

Configuration: testing.matches

Hi!
how are we supposed to configure the path to "C:/Users/w/PycharmProjects/AvaddonDecryptor/testing.matches" ?
Line 111 of main.py

EDIT: Creating an empty file would pass the error to line 112.