3

So I have some encrypted data in this executable. IDA couldn't do much with it, so it defined it as arrays. Now I know how to decrypt this data, and it has some encrypted code. I could of course, put the encrypted data into some separate file, run the decryption on it, and then let IDA process it, but then it looses connection to the original executable.

Is it possible to replace the encrypted data 1:1 with the decrypted one, so I can let IDA process it, in the context of the executable?

Improve this question
1

2 Answers 2

Reset to default
4

Depending on the layout of the binary, where the data you want to modify is and how complex the transformation is I would pick one of the following solutions:

  1. If the transformation is simple and can be trivially done in a hex editor using one of its built in operations I would open the original input file in the hex editor, run the transformation and then in IDA select File, Load File, Reload the Input file.

  2. If the transformation is complex and/or results in a new segment being mapped I would create an IDC or IDAPython script which does the transformation for you. The documentation for IDAPython can be found on hex rays website. The documentation for IDC can also be found on their website. They also have a small set of IDC tutorials on there. IDC functions you're particularly interested in are: AddSeg(), Qword(), Dword(), Word(), Byte(), PatchDword(), PatchWord(), PatchByte().

Improve this answer
1
  • Thanks for that overview. The decrypted code is position independent and doesn't need any new segments, so I try the idea with the memory snapshot first, as it sounds simpler. I guess in the long run, learning the python interface might have benefits though. :)
    – Devolus
    Oct 27, 2013 at 16:25
4

Just debug the file in IDA itself and take a memory snapshot once the data is decrypted.

Improve this answer
2
  • Can the address be adjusted? Because the block is allocated and then decrypted to that memory, so the snapshot would not have the original adress.
    – Devolus
    Oct 27, 2013 at 16:21
  • I like this suggestion.. Why even bother doing it if you can just have the program do the work for you. I guess if the binary isn't debuggable by IDA you'd need to drop down to the harder methods. There's also an element of proving to yourself that you actually understand the transformation.
    – Peter Andersson
    Oct 27, 2013 at 16:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.