As part of a CTF challenge I have to understand the inner workings of a cryptlock type malware, and use it to decrypt a file containing the flag.
I used GHIDRA to decompile the binary.
The encryption function seems pretty basic, it is just the following line inside a while loop repeated until all bytes of the file have been xored :
local_111c[local_1120] = local_111c[local_1120] ^ *(byte *)(param_2 + local_1120 % 0x20);
local_1120 is the loop counter,
local_111c is a buffer where the file to encrypt is read into, and
param_2 is an integer that seems to be always 0, the function is called like the following
FUN_00401000((LPCSTR)0x0,0), with both parameters set to 0;
*(byte *)(param_2 + local_1120 % 0x20 refer to? As far as I understand it, it would be the value at the address pointed to by an integer cast to a byte pointer, but the modulo makes it so the adress can't be above 32?
I need to understand what could the value pointed to could have been in order to xor back the file to its original state.