Evening Ladies and Gents,
I have a quite small EXE, 60KB total, that needs to be reversed into a .NET solution. This exe is a decrypter for an old virus im trying to archive. This infection used a XOR with a clever hand made form of CFB encryption to encrypt files, Though you dont need to know about that or cryptography, all you need to know is how to disassemble it to a .net solution.
This infection had 2 versions. The first version only used a 8 byte key and only encrypted 512 byte of the files. The second version used 20 bytes and encrypted 2048 bytes of the files. Thus there is 2 decrypter versions also.
Some good news is i have already disassembled and coded a .NET version of the 2nd decrypter that uses the 20 byte key. The reason this is good news is, the decrypters are almost identical except that V1 uses a 8 byte key, and only decrypts 512 bytes.
This is why i need it reversed and i simply do not have time to do it. I need to know how the decryption function uses the 8 byte key compared to the V2 version that uses the 20 byte key. It is slightly different and is the main thing i need to know, So honestly you could prob get away with only reversing 2 functions in this whole thing if you communicate with me.
I can share the source of the V2 decrypter, so that it makes it much easier (remember they are almost identical), and also with communicating with me, only a few functions need reversed. This job should only take someone who knows how to use a disassembler (prob. IDA), assembly, and some form of .NET language, 1 - 2 hours. This is also why i will not go above $100 dollars for this job. I have done the last one myself, and it is quite simple and small, Especially If you communicate with me, then all you need to do is disassemble 2 functions. All bids over this amount will be ignored, Thanks for understanding.
Please do not bid if you do not have the qualifications for this job. Once again the minimum skills required is knowing assembly enough to reverse a exe.
Attached below is a RAR file, This file contains the EXE to reverse, and a encrypted file that it decrypts. The RAR password is "123"
Let me be clear though! The exe is not in ANYWAY a infection, or dangerous. It is simply a small exe that reverses a encryption that a different exe caused!
Please contact me for more information.