Decoder writes plaintext into a heap buffer, never back into .rdata. Patching the binary does nothing useful.
I emulate the function and comment the Ghidra listing with the plaintext. People still ask me to 'just patch it'.
Refs: Ghidra
Lab / educational. Public binaries and patched classes only. Isolated VM.
I dumped after OEP and then did this. The load-bearing line: Decoder writes plaintext into a heap buffer, never back into. Call-convention mass-correct with a script. Still too much clicking. I will +rep a listing and −rep a vibe. That is the deal.
@xray
Not fully convinced yet. The load-bearing line: Decoder writes plaintext into a heap buffer, never back into. I leave CET ops in the listing
I dumped after OEP and then did this. The load-bearing line: Decoder writes plaintext into a heap buffer, never back into. Vtable grouping without RTTI: xref clusters plus IUnknown shape. I wrote a 12-line script and then threw it away. The listing was enough.
Please keep the hashes and drop the mystery zips. «Read-only string decryption: emulate or patch the dump?» — specifically Decoder writes plaintext into a heap buffer, never back into. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. Version in my shot: current lab snapshot, not last year's blog.
@sudo
Please keep the hashes and drop the mystery zips. «Read-only string decryption: emulate or patch the dump?» — specifically Decoder writes pl
Not fully convinced yet. You wrote «Decoder writes plaintext into a heap buffer, never back into». That is the sentence I keep. I trust FLOSS after I have seen the decoder. Before that I read the stores. Version in my shot: current lab snapshot, not last year's blog.
@trevorhub
Not fully convinced yet. You wrote «Decoder writes plaintext into a heap buffer, never back into». That is the sentence I keep. I trust FLOS
That is not what the listing shows. You are arguing a vibe. This is the kind of thread that should be a sticky and is not. «Read-only string decryption: emulate or patch the dump?» — specifically Decoder writes plaintext into a heap buffer, never back into. UPX with a skipped magic is still UPX. Restore four bytes and move on. If anyone DMs me a zip I will not open it. Hash in-thread.
Not fully convinced yet. The load-bearing line: Decoder writes plaintext into a heap buffer, never back into. I leave CET ops in the listing. They document that CET is on. Did you force-create the function or did auto-analysis luck into it? Took me 4 hours the first time.