Reverse Engineering for Beginners

(avery) #1

CHAPTER 84. PRIMITIVE XOR-ENCRYPTION CHAPTER 84. PRIMITIVE XOR-ENCRYPTION


84.1 Norton Guide: simplest possible 1-byte XOR encryption.


Norton Guide^1 was popular in the epoch of MS-DOS, it was a resident program that worked as a hypertext reference manual.


Norton Guide’s databases are files with the extension .ng, the contents of which look encrypted:


Figure 84.1:Very typical look

Why did we think that it’s encrypted but not compressed? We see that the 0x1A byte (looking like “→”) occurs often, it would
not be possible in a compressed file. We also see long parts that consist only of latin letters, and they look like strings in
an unknown language.


(^1) wikipedia

Free download pdf