Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Reverse engineering stuff like this can be fun. I remember trying to reverse engineer some random .exe that got emailed to me once.

I disassembled it but all I found was some basic initialization code and then a jmp to an address that didn't seem to exist. However when I ran it (in a VM) with a debugger it seemed to go through all kinds of Win32 Calls.

Very odd



It's very common for malware (or other code that doesn't want to be reverse engineered) to be decrypting itself in the that initialization loop to generate the code that is jumped to. It is also very common for malware to use exception handling as control flow, which could also explain a nonsense jump.


That certainly makes sense, I wonder if it is encrypted using any proper scheme or something simple like XOR?

If it is strong encryption I suppose the thing to do would be to capture the key in memory, but that would require more patience than I have.


Usually it doesn't matter, you just let the exe decrypt itself, then grab the decrypted code and rebuild the PE with it.




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: