diff --git a/dynamic.md b/dynamic.md index 9d0bf48..e901635 100644 --- a/dynamic.md +++ b/dynamic.md @@ -39,7 +39,8 @@ You will need to sync the debugger and disassembler addresses so you can follow ### XOR Decode Function -Remember use the F2(breakpoint), F7(Step Into), F8(Step Over), F9(Run) keys to navigate through the debugger. +Remember use the F2(breakpoint), F7(Step Into), F8(Step Over), F9(Run) keys to navigate through the debugger. If you accidentally run past the end the of the program you can always restart by clicking ![alt text](https://securedorg.github.io/images/restart.png "restart"). + ![alt text](https://securedorg.github.io/images/dyn6.png "xordecode") In **IDA**, get the offset of the XorDecode function you saved prior. diff --git a/images/restart.png b/images/restart.png new file mode 100644 index 0000000..8d6dbc6 Binary files /dev/null and b/images/restart.png differ diff --git a/static.md b/static.md index 9eb7079..7b6db2b 100644 --- a/static.md +++ b/static.md @@ -117,7 +117,7 @@ We can assume that this function is doing some kind of Xor encoding. So let's re Let's use the tool **XORSearch** to see if we can find some interesting xor decoded strings. Open the terminal **cmd.exe** from the start bar, and navigate to the XORSearch.exe -```XORSearch.exe "A string to test"``` +```XORSearch.exe "A string to test"``` *Click Image to Enlarge* [![alt text](https://securedorg.github.io/images/static6.png "xor search")](https://securedorg.github.io/images/static6.png)