Posted: Mon May 30, 2016 12:11 am Post subject: dumping decoded files
Hi,
I have a program A which uses sets of encoded(encrypted) files. While the program is running these files will be decoded somehow (I dont know how). I tried to look for them in Memory View but I only can find chunks of each file. What steps should I follow to achieve this goal?
Joined: 25 Jan 2006 Posts: 8586 Location: 127.0.0.1
Posted: Mon May 30, 2016 1:34 pm Post subject:
For something like this, looking for the file location, name, or extension is usually a helpful thing to try and locate the code that handles the decoding/decryption of the files.
Using a tool like IDA (disassembler) is usually easier to deal with this as well instead of trying to do it while the application is running with a memory scanner/debugger like Cheat Engine. _________________
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum