This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

Booba Ransomware Recovery Toolkit

Tools for recovering files encrypted by Booba Team ransomware without the attacker's private key.

---

How it works

Every Booba-encrypted file has this structure:

[ encrypted header ~5% ][ intact body ~95% ][ 240-byte ECDH footer ]

The encrypted header is exactly floor(file_size / 20) bytes. Everything after that is untouched.
The toolkit strips the footer, discards the encrypted header, and applies format-aware reconstruction to make the remaining 95% fully usable.

---

Quick start

Windows — no install required:

1. Download BoobaRecovery.exe from the Releases page
2. Run it on any Windows machine — no Python needed
3. Select your encrypted folder, select an output folder, click Start Recovery

From source (any OS):

pip install -r requirements.txt
python3 booba_recover.py /path/to/encrypted /path/to/output

---

Recovery approaches

Approach	Key needed	What you get
Partial recovery — booba_recover.py / GUI	None	~95% of every file; format-aware reconstruction
Full decryption — booba_decrypt.py --mode full	Attacker's 32-byte Curve25519 private key	100% original file
Known-plaintext — booba_decrypt.py --mode known-plaintext	None (built-in keystreams for 2 specific SQL files)	100% for those files

---

Wiki pages

• GUI Usage — Step-by-step walkthrough of the Windows GUI with screenshots
• Format Support — Every supported file type and exactly what gets recovered
• Command Line — CLI reference for all four tools
• Building the EXE — How to build BoobaRecovery.exe with PyInstaller

---

Ransomware technical details

• Cipher: HC-128 stream cipher (eSTREAM finalist)
• Key exchange: Curve25519 ECDH — victim ephemeral keypair × attacker hardcoded public key → SHA-256 → 16-byte key + 16-byte IV
• Footer size: 240 bytes
• Footer magic: \x03\x00\x00\x00
• Encryption scope: First floor(size/20) bytes only; 95% of every file is completely intact