That certainly makes sense, I wonder if it is encrypted using any proper scheme ... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

jiggy2011 on April 24, 2012 | parent | context | favorite | on: Pwning a Spammer's Keylogger

That certainly makes sense, I wonder if it is encrypted using any proper scheme or something simple like XOR?

If it is strong encryption I suppose the thing to do would be to capture the key in memory, but that would require more patience than I have.

Sapient on April 24, 2012 [–]

Usually it doesn't matter, you just let the exe decrypt itself, then grab the decrypted code and rebuild the PE with it.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact