Binary Ninja actually provides transformer to automatically decrypt XOR encrypted values without having to write a loop, for this you would typically do the following Transform['XOR'].decode(enc_data, {'key': key_data}), you could setup a value that holds the transformer, t = Transform['XOR'] and then t.decode()...
The confusing arg1 is presumably supposed to be a pointer type (not an int type), likely to some table of functions. I assume that Binary Ninja can retype it somehow.
hi john, long time viewer here hoping this message would be read by you. I was wondering you had any resources/knowledge about analyzing pyd/cython dynamic libraries. I know you've done an analysis on py2exe or pyinstaller a while back (actually the reason i found you channel a long time ago), i literally cannot for the life of me figure out what goes on in the pyd (which are often actually the main/most important section of a unpacked py2exe executable). certainly appearing to have A LOT of junk, regardless of what i try to analyze. Would be a very helpful video for the future!
62°33'29.9"N 97°24'23.5"E 8:23
Thx for this morning juice....
At the beginning of the video, it looks like arg1 is an array of function pointers.
Binja is such a great tool!
Is this video taken from your livestream or something?
Great video. Learned something new today!
Finally, binja again with python scripting
I would have been fine with extending the investigation in this video. :)
Would go ahead and disagree with you there John, reverse engineering makes for very interesting youtube videos. This was a great one.
Could just debug or break it at the decode and dump it unencrypted
John, people who use Hexadecimal, are they non-binary?
Thats insane, such a powerful tool
First
Interesting 👾
Second
in what world is reverse engineering vids boring.??
@_JohnHammond