1
2
3
4
5
6
7
8
9
10
11
12
import re

def extract_qakbot_config(data):
    pattern = rb'\x00\x00\x00\x01.{4}(.{256})'
    matches = re.findall(pattern, data, re.DOTALL)
    return matches

if __name__ == "__main__":
    with open("sample.bin", "rb") as f:
        data = f.read()
    config = extract_qakbot_config(data)
    print(config)