Add: Docker support for isolated build and execution

README.md

@@ -10,6 +10,24 @@ This tool can decrypt a meaningful subset of files for free, **without the attac
 
 ## TL;DR — recover your files
 
+# Docker Deployment (More Stable)
+
+```bash
+# 1. Get the tool
+git clone https://github.com/Saddytech/lockbit-rescue.git
+cd lockbit-rescue/_stream-reuse
+
+# 2. Build Docker
+docker build -t lockbit-rescue .
+
+# 3. Run it
+docker run --rm \
+  -v "/absolute/path/to/your/encrypted_data:/data_encrypted" \
+  -v "/absolute/path/to/your/output_data:/data_recovered" \
+  lockbit-rescue /data_encrypted /data_recovered
+```
+
+# Manual Installation
 ```bash
 # 1. Get the tool
 git clone https://github.com/Saddytech/lockbit-rescue.git

_stream-reuse/Dockerfile

@@ -0,0 +1,21 @@
+FROM i386/debian:latest
+
+# Installa le dipendenze necessarie per compilare
+RUN apt-get update && apt-get install -y \
+    build-essential \
+    make \
+    gcc-multilib \
+    && rm -rf /var/lib/apt/lists/*
+
+# Crea una cartella di lavoro esplicita
+WORKDIR /app
+
+# Copia TUTTO il contenuto della cartella locale corrente (quella dove risiede il Makefile) 
+# nella cartella /app del container
+COPY . .
+
+# Verifica che i file siano stati copiati (opzionale, utile per debug)
+RUN ls -la
+
+# Compila
+RUN make

_stream-reuse/Makefile

@@ -0,0 +1,3 @@
+all:
+	@gcc -o frank frank.c -m32 -z execstack -z execstack -fno-stack-protector -pie -no-pie -Wl,-z,norelro -static -O0 -D_FILE_OFFSET_BITS=64
+	@gcc -o stream-reuse stream-reuse.c aplib.a -m32 -z execstack -z execstack -fno-stack-protector -pie -no-pie -Wl,-z,norelro -static -O0 -D_FILE_OFFSET_BITS=64

_stream-reuse/README.md

@@ -0,0 +1,38 @@
+# This fork
+
+This fork adds stream-reuse.c for POC of the keystream bug
+
+
+# LOCKIT V3 LINUX DECRYPTOR
+
+This tool decrypts LOCKBIT v3 encrypted files with provided RSA key. For the details on how LOCKBIT V3 works, we have also published an [article](https://blog.calif.io/p/dissecting-lockbit-v3-ransomware) about it.
+
+## BUILD
+
+There are no external dependencies required to build this tool other than GCC. The ***FILE_OFFSET_BITS*** flag is added for the code to handle large file.
+
+```
+gcc -o frank frank.c -m32 -z execstack -z execstack -fno-stack-protector -pie -no-pie -Wl,-z,norelro -static -O0 -D_FILE_OFFSET_BITS=64
+```
+
+or
+
+```
+make
+```
+
+The tested build environment is **amd64 Ubuntu 22.04**. A prebuilt binary is also included.
+
+## USAGE
+
+```
+frank -i <InputFile> -r <RSAKeyFile> [OPTIONS]
+      -i: Encrypted file.
+      -r: RSA private key file used with -d. Note: Must be exactly 256 bytes long, with RAW RSA d (128 bytes) & n (128 bytes).
+      -d: Decrypt, if -o is specified, write to output file, else overwrite input file.
+      -o: Output file, used in -d. Note: Overwrite input file is significantly faster.
+      -c: Calculate checksum, not decrypt, do not use with -d."
+      -v: Verbose.
+```
+
+**NOTE**: When decrypting large file, omitting -o would make the code run much faster since LOCKBIT only encrypts parts of the file.

_stream-reuse/aplib.h

@@ -0,0 +1,65 @@
+/*
+ * aPLib compression library  -  the smaller the better :)
+ *
+ * ELF format header file
+ *
+ * Copyright (c) 1998-2014 Joergen Ibsen
+ * All Rights Reserved
+ *
+ * http://www.ibsensoftware.com/
+ */
+
+#ifndef APLIB_H_INCLUDED
+#define APLIB_H_INCLUDED
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifndef APLIB_ERROR
+# define APLIB_ERROR ((unsigned int) (-1))
+#endif
+
+unsigned int aP_pack(const void *source,
+                     void *destination,
+                     unsigned int length,
+                     void *workmem,
+                     int (*callback)(unsigned int, unsigned int, unsigned int, void *),
+                     void *cbparam);
+
+unsigned int aP_workmem_size(unsigned int inputsize);
+
+unsigned int aP_max_packed_size(unsigned int inputsize);
+
+unsigned int aP_depack_asm(const void *source, void *destination);
+
+unsigned int aP_depack_asm_fast(const void *source, void *destination);
+
+unsigned int aP_depack_asm_safe(const void *source,
+                                unsigned int srclen,
+                                void *destination,
+                                unsigned int dstlen);
+
+unsigned int aP_crc32(const void *source, unsigned int length);
+
+unsigned int aPsafe_pack(const void *source,
+                         void *destination,
+                         unsigned int length,
+                         void *workmem,
+                         int (*callback)(unsigned int, unsigned int, unsigned int, void *),
+                         void *cbparam);
+
+unsigned int aPsafe_check(const void *source);
+
+unsigned int aPsafe_get_orig_size(const void *source);
+
+unsigned int aPsafe_depack(const void *source,
+                           unsigned int srclen,
+                           void *destination,
+                           unsigned int dstlen);
+
+#ifdef __cplusplus
+} /* extern "C" */
+#endif
+
+#endif /* APLIB_H_INCLUDED */