Forum Discussion
DFIR CTF: PCAP Challenge - Question 7
The notes from when I did this say:
"First look at the silverlight file to work out what a normal exe file looks like and where the nulls are…
Then look at the two encrypted Bfl files - and see what text repeats…"
Followed by a screenshot that I can't share, as it will just give you the answer... ;-)
Basically, the issue is that when you XOR a file containing null values with a static key, the key ends up being repeated verbatim in the cipher text...
AmbassadorThe notes from when I did this say:
"First look at the silverlight file to work out what a normal exe file looks like and where the nulls are…
Then look at the two encrypted Bfl files - and see what text repeats…"
Followed by a screenshot that I can't share, as it will just give you the answer... ;-)
Basically, the issue is that when you XOR a file containing null values with a static key, the key ends up being repeated verbatim in the cipher text...
