"Custom crypto" sample

[v-p-b]

I created a small sample to play with ripr. The analyzed binary is based on this RC4 code:

https://gist.github.com/rverton/a44fc8ca67ab9ec32089

I added a static XOR step to make it a "non-standard" implementation and to see how static obfuscation keys can be handled by ripr.

My goal is to do a writeup based on this experiment, to document the process of using ripr to create standalone implementations of custom obfuscators/crypto. At the current state the ripr code successfully replicates the output of the original binary, but I wonder if the authors can add their comments to highlight some best practices, easier/better solutions.

[pbiernat]

Hey, thanks for taking the time to make an in-depth usage sample like this!

I saw your writeup this morning; I'll try to take a closer look at ripr itself to see if I can improve/automatically resolve some of the issues you ran into along the way.