# Decode Base64 + XOR Shellcode
> Extract shellcode encoded as Base64 with an XOR key

**Tools:** [[tools/base64dump-py|base64dump-py]], [[tools/translate-py|translate-py]]
**FOR610 Lab:** 3.4

## Commands
```bash
# Find Base64 strings
base64dump.py <script.ps1> -n 10
# Decode Base64, then XOR with key
base64dump.py <script.ps1> -s <selection> -d | translate.py 'byte ^ <key>' > shellcode.bin
```

#recipe #base64dump-py #translate-py