That certainly makes sense, I wonder if it is encrypted using any proper scheme ... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

jiggy2011 on April 24, 2012 | parent | context | favorite | on: Pwning a Spammer's Keylogger

That certainly makes sense, I wonder if it is encrypted using any proper scheme or something simple like XOR?

If it is strong encryption I suppose the thing to do would be to capture the key in memory, but that would require more patience than I have.

Sapient on April 24, 2012 [–]

Usually it doesn't matter, you just let the exe decrypt itself, then grab the decrypted code and rebuild the PE with it.

Consider applying for YC's Fall 2026 batch! Applications are open till July 27.
Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact