Mastering Reverse Engineering

Simple XOR decryption

XOR is the most popularly used operator when it comes to software cryptography. If we were to change the code algorithm in the previous code snippet, it would look like this:

 mov ecx, 0x10 mov esi, 0x00402000loc_00401000: mov al, [esi] xor al, 0x20 mov [esi], al inc esi dec ecx jnz loc_00401000

What makes it popular is that the same algorithm can be used to encrypt and decrypt data. Using the same key, XOR can restore the original data back. Unlike when using SUB, the data-restoring counterpart requires an algorithm that uses ADD.

Here's a quick demonstration:

Encryption using the key 0x20:  data:  0x46 = 01000110b   key:  0x20 = 00100000b0x46 XOR 0x20 = 01100110b = 0x66Decryption using the same key: data: 0x66 = 01100110b ...