IDA Pro Debugger: Leveraging the Take Memory Snapshot Feature

In this video, we are going to see that we can get decrypted code very fast in our IDB without bothering to write IDA Python scripts. In those examples, I am using simple XOR, but it is very simple to change the algorithm to something more complex and custom. I don't want to spend time coding a script when I can just use a very nice feature presented in this IDA Pro Debugger Tutorial.

Here are the 3 examples for today:

- A simple encrypted PE file with a few visible layers

- An encrypted PE file with 60 layers which are hidden

(I will show you how you can use the trace feature to find the start

 of decrypted code without any effort as well in this example)

- One PE file decrypting and executing routine onto allocated memory

In those 3 examples, we will see how the memory snapshot feature can save you a lot of time

https://www.youtube.com/redirect?q=https%3A%2F%2Fwww.reverse-engineer.net%2Fhexorcism&event=video_description&redir_token=QUFFLUhqbDFvb0hTcUd2c2V1SUJoYnkzNFpnZWJQUGx6QXxBQ3Jtc0ttRFBabG93cVRISlRqeVhHbzBMOGJuUlhoRmFVUjBFSUR4dF85eG8xOFd5azNWeXFSWnJDQVUyaGE5Z1BGdVhLMlhFaDZKcFZDdVZsQkNsaGN6MHRtWXBHZ3ZOcXBHMFlwbkxIdkRTVHlqaTRybFFRUQ%3D%3D&v=plaRysF1cxk

https://www.youtube.com/watch?v=plaRysF1cxk

[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法