2

enter image description herei have been working on a bug for almost a year trying to figure out how i can fix it. the app is suppose to show some message like ("Processing")to notify a user that the main function is executed, so since Delphi is easy to reverse with its strings. i have searched for encryption using Olly's SnD Crypto plugin and i have found the following

 CRC32(table)
 CRC32b(table)
 MD5
 SHA1
 SHA256
 Base64 alphabet
 Base64 alphabet(Unicode/VB)
 ENIGMA encryption algorithm(WiteG)
 RC4 encryption algorithm

according to the plugin Enigma was used to protect two pieces in CODE section which i thought is hiding an Algorithm. RC4 is protecting most pieces of the DATA sections probably the Base64 encoded strings so dealing with strings is a none start for me because if it wasn't like that i would look for a messagebox Api or Search for strings.

i would like to Decrypt Enigma then simply follow through since the app is an email transporter i will know the function and in i will be able to see where the message should be executed.

how can i decrypt ENIGIMA thats mostly my question?

thank you

1 Answer 1

1

RC4 can be unpacked manually using OLLYDBG and break-pointing on VirtualAlloc Enigma is triky because there is enigma protector which is a packer of course its just a matter of finding Original Entry Point

the hardest is Enigma Vitualbox which is a crypter fully undetectable by PEiD but somebody released a program to unpack it, in my case the program didnt successfully decrypt Enigma it doesnt find engma entrypoint so i used ollydbg to manually break on CreateProcessA

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.