0

Say i have Windows executable that looks like normal one, but actually has encrypted segments or blocks of code, and the way it calculates key to decrypt itself at run-time way hard for me.

I'd like to try create a decrypted version of that program by stripping out "self-decryptor part" and exporting program as it was at run-time (under debug). I am not looking for way to find & remove decryption-related code.

Having IDA Pro (or other tools), how can i re-save executable file at run-time (after program decrypted itself), or i am thinking in completely wrong direction and should not try doing it?

I've read this answer and question but i am wondering if i really cannot just re-save executable at runtime and try to make it "runnable"? Is this possible?

closed as unclear what you're asking by peter ferrie, 0xec, w s, perror, ebux Mar 18 '16 at 8:01

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

2

If you are dealing with a packed/crypted executable it is not possible to just dump the file from memory and make it "runnable". You need to do at least two things:

To do these two things, you need to have some basic understanding about the PE file format. You can find some useful links about the PE file format in this answer.

If you know what type of crypter/packer is being used on the file, feel free to upload the sample or tell me so I can maybe give you some guidelines on obtaining the payload. You can check this with a tool like PEid or ExeInfo.

Not the answer you're looking for? Browse other questions tagged or ask your own question.