Hacker News Reader

jiggy2011

Reverse engineering stuff like this can be fun. I remember trying to reverse engineer some random .exe that got emailed to me once.

I disassembled it but all I found was some basic initialization code and then a jmp to an address that didn't seem to exist. However when I ran it (in a VM) with a debugger it seemed to go through all kinds of Win32 Calls.

Very odd

View on HN

It's very common for malware (or other code that doesn't want to be reverse engineered) to be decrypting itself in the that initialization loop to generate the code that is jumped to. It is also very common for malware to use exception handling as control flow, which could also explain a nonsense jump.

That certainly makes sense, I wonder if it is encrypted using any proper scheme or something simple like XOR?

If it is strong encryption I suppose the thing to do would be to capture the key in memory, but that would require more patience than I have.

Usually it doesn't matter, you just let the exe decrypt itself, then grab the decrypted code and rebuild the PE with it.

Reply on news.ycombinator.com