IDA Pro Debugger: Leveraging the Take Memory Snapshot Feature

In this video, we are going to see that we can get decrypted code very fast in our IDB without bothering to write IDA Python scripts. In those examples, I am using simple XOR, but it is very simple to change the algorithm to something more complex and custom. I don't want to spend time coding a script when I can just use a very nice feature presented in this IDA Pro Debugger Tutorial.

Here are the 3 examples for today:

- A simple encrypted PE file with a few visible layers

- An encrypted PE file with 60 layers which are hidden

(I will show you how you can use the trace feature to find the start

 of decrypted code without any effort as well in this example)

- One PE file decrypting and executing routine onto allocated memory

In those 3 examples, we will see how the memory snapshot feature can save you a lot of time

https://www.youtube.com/redirect?q=https%3A%2F%2Fwww.reverse-engineer.net%2Fhexorcism&event=video_description&redir_token=QUFFLUhqbDFvb0hTcUd2c2V1SUJoYnkzNFpnZWJQUGx6QXxBQ3Jtc0ttRFBabG93cVRISlRqeVhHbzBMOGJuUlhoRmFVUjBFSUR4dF85eG8xOFd5azNWeXFSWnJDQVUyaGE5Z1BGdVhLMlhFaDZKcFZDdVZsQkNsaGN6MHRtWXBHZ3ZOcXBHMFlwbkxIdkRTVHlqaTRybFFRUQ%3D%3D&v=plaRysF1cxk

https://www.youtube.com/watch?v=plaRysF1cxk

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课