0

Hello to everyone in RE section!

I have a binary file with questionable extension(meaning idk if its exe/dll). Multiple variations of this file can be acquired throught connection to remote CDN via program launcher and then saved to disk.

At first glance (for my limited knowledge view atleast), it appears to be that they are encrypted is some way.

The program itself unpacks atleast 2 files with .sys and .dll extensions from said file. As I said before multiple variations of this file are nearly identical in supposed PE signature region.

First 112 bytes nearly identical, and supposed extension signature always the same (first 3-4 bytes).

First file:

FirstFile

Second file:

SecondFile

Also it appears to me that sequence of chars cfilorux repeats itself multiple times. Am I correct to assume that its XOR encryption?

1
  • That seems likely, yes, since you’ve got two identical / virtually identical headers. Your best bet as always would be to find the code that does the decryption to work out what the sequence it’s xored with is, but you could also try xoring those fragments against the start of a similar PE file to see if there’s any obvious sequence in the xor stream. If it looks random then it may be a stream cipher you can’t crack and you’ll have to find the decrypt code.
    – Rup
    Sep 14, 2022 at 9:45

1 Answer 1

1

Forgot to answer my own question after the hint by Rup.

So essentially I found decryption function in .text section of program launcher with IDA.

{
  unsigned int v2; // eax
  if (imageSize >= 2) {
    image[imageSize - 1] += 3 - 3 * imageSize;
    v2 = imageSize - 2;
    if (imageSize != 2) {
      do {
        image[v2] += -3 * v2 - image[v2 + 1];
        --v2;
      }
      while (v2);
    }
    *image -= image[1];
  }
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.