View Full Version : Exclusive known as xor crypto, how to read the uncrypted string
nah
July 23rd, 2009, 02:08
Well the the dynamic dll has some of its strings protected by exclusive or crypting known as xor. I would like to read out those strings but i dont know how, searched googles and several froums i found out that people are using ida pro plugin x 86 emu but that plugin crashes after some steps into and wont read out the strings.
Im using ida pro 5.2 also having olly dbg.
Anyone who has a clue what i could do or know some special plugins please answer THX!
squidge
July 23rd, 2009, 12:00
I use UltraEdit and Calc usually until I've broken the code and then whip up in a decryptor in Visual Studio when I've got enough info. For how long it takes I normally don't bother with plugins.
nah
July 23rd, 2009, 12:46
can u specifie what is calc?
squidge
July 23rd, 2009, 13:15
Sure, Start->Run->Calc
habituallurker
July 23rd, 2009, 20:51
Watch out for that xor crypto ... rumor has it the NSA might be able to break it, but I doubt it...
DARKER
July 26th, 2009, 01:41
Quote:
Well the the dynamic dll has some of its strings protected by exclusive or crypting known as xor. I would like to read out those strings but i dont know how |
If it's simple XOR, ADD, SUB and ROR/L (1 byte password) and you know some know string from DLL you can use
http://progress-tools.110mb.com/xortool.html ("http://progress-tools.110mb.com/xortool.html") for searching or decoding whole file for preview what is inside.
Powered by vBulletin® Version 4.2.2 Copyright © 2018 vBulletin Solutions, Inc. All rights reserved.