Exclusive known as xor crypto, how to read the uncrypted string [Archive]

View Full Version : Exclusive known as xor crypto, how to read the uncrypted string

nah

07-23-2009, 03:08 AM

Well the the dynamic dll has some of its strings protected by exclusive or crypting known as xor. I would like to read out those strings but i dont know how, searched googles and several froums i found out that people are using ida pro plugin x 86 emu but that plugin crashes after some steps into and wont read out the strings.

Im using ida pro 5.2 also having olly dbg.

Anyone who has a clue what i could do or know some special plugins please answer THX!

squidge

07-23-2009, 01:00 PM

I use UltraEdit and Calc usually until I've broken the code and then whip up in a decryptor in Visual Studio when I've got enough info. For how long it takes I normally don't bother with plugins.

nah

07-23-2009, 01:46 PM

can u specifie what is calc?

squidge

07-23-2009, 02:15 PM

Sure, Start->Run->Calc

habituallurker

07-23-2009, 09:51 PM

Watch out for that xor crypto ... rumor has it the NSA might be able to break it, but I doubt it...

DARKER

07-26-2009, 02:41 AM

Quote:

Well the the dynamic dll has some of its strings protected by exclusive or crypting known as xor. I would like to read out those strings but i dont know how

If it's simple XOR, ADD, SUB and ROR/L (1 byte password) and you know some know string from DLL you can use
http://progress-tools.110mb.com/xortool.html ("http://progress-tools.110mb.com/xortool.html") for searching or decoding whole file for preview what is inside.