Say i have Windows executable that looks like normal one, but actually has encrypted segments or blocks of code, and the way it calculates key to decrypt itself at run-time way hard for me.

I'd like to try create a decrypted version of that program by stripping out "self-decryptor part" and exporting program as it was at run-time (under debug). I am not looking for way to find & remove decryption-related code.

Having IDA Pro (or other tools), how can i re-save executable file at run-time (after program decrypted itself), or i am thinking in completely wrong direction and should not try doing it?

I've read this answer and question but i am wondering if i really cannot just re-save executable at runtime and try to make it "runnable"? Is this possible?


If you are dealing with a packed/crypted executable it is not possible to just dump the file from memory and make it "runnable". You need to do at least two things:

To do these two things, you need to have some basic understanding about the PE file format. You can find some useful links about the PE file format in this answer.

If you know what type of crypter/packer is being used on the file, feel free to upload the sample or tell me so I can maybe give you some guidelines on obtaining the payload. You can check this with a tool like PEid or ExeInfo.

Not the answer you're looking for? Browse other questions tagged or ask your own question.