Hello,

i'm using w32dasm, but all strings and comments are encrypted.
Is it possible to decrypt it?

C0d3r-F4N, please do yourself a favor and use the free version of IDA:

https://www.hex-rays.com/products/ida/support/download_freeware.shtml

WDasm was notorious for not parsing all strings correctly, and unicode strings not at all. Unless you're absolutely sure about it, it's possible that the strings aren't even encrypted at all, just that WDasm can't handle them.

From your posts it's obvious that you want to learn, and that's great to see. But you might as well learn to use the proper tools from the start. WDasm is very old and deprecated and IDA is far, far, far superior for a number of reasons. If in fact your strings are encrypted and the situation is fairly simple, you might even learn how to use an IDA script to decrypt them, such is the capability of the tool. Simply being able to view things like unlimited cross-references (XREFS) in IDA, you'll find that your reversing sessions will be much more effective and enjoyable. At least give it a try over WDasm and see what you think - Please!

Kayaker

In OllyDbg i see this encrypted Strings in CPU-window (comment) too, but not all encrypted.
In OllyDbg under All referenced text strings are all readable (all ok).

I only want to use free tools, IDA isn't!
IDA 5.0 is old, like wdasm, so IDA 5.0 it's free.

Hi C0d3r-F4N,

if you have time and will to experiment, you could try some of the stuff enumerated in this thread...
http://reverseengineering.stackexchange.com/questions/1817/is-there-any-disassembler-to-rival-ida-pro ("http://reverseengineering.stackexchange.com/questions/1817/is-there-any-disassembler-to-rival-ida-pro")

I unfortunately cannot give advices to you, because I use IDA... Even if I think it could be more powerful with some little effort (ever tried to decompile MFC programs?)

Best regards
bilbo

Yes, i have time.
I know it's a long way to learn...

No, never.
I'm a newbie.

you want to learn

post back how you will approach this encranked trings

Bad Evil blabberer. This is real?

Not Base64 - regions of low entropy (randomness of characters), no trailing padding characters (=) that would be present from a 532 character result
Not Base64 with custom index table - non-randomness of characters seems to preclude that

Didier Stevens XORSearch ("http://blog.didierstevens.com/programs/xorsearch/")- no results given for common words (the, and, http)

Custom job then. Is there a way to guess possible bitwise operations used in the algo by focussing on certain characters? For example, what operations (xor,shl,shr,rol,ror) keep the first character (N) as a capital letter, and convert the second character (3) to a small letter (ASS-uming this is an encrypted sentence)?

What other strategies could one use on a random encrypted string totally devoid of context?

all i know is that a glutonion dwarf captured this tring when it was trying to impress itself into a hovulan crater which supposedly contains a hordeload of zuper cekret gilica zell centerfusing treactors the dwarf sold this tring as a jeero night to hyest bedder and lo every badbug and its cousins now have a copy of this tring and is go ogling for more
yours truly is a distant cousin of a distant cousin of a distant .........tingering the tring