XOR Operation - How?

[Randy Brown]

I have a keylog file that I captured and it is encrypted by the virus. It
requires a XOR operation of each byte. I would like to see what the contents
of the file is so I know if I lost anything.

I looked in Access and there is XOR operation or function. I tried
cimporting the data, and then using the Expression Builder to XOR it. All I
found were 0's...

An example of the file is hex code:

03 34 3e 3b .....

I'm told that if I XOR it with the key, I can get to the data. I found the
key... Hopw can I do this in Access? Can I?

Thanks!

 

[TC]

It's hard to answer unless you know the encryption algorithym. Lots of
different encryption algorithyms are based on XOR. Knowing that it's
based on XOR, is not even nearly enough!

Say you have a 4-byte key (k1 - k4).

One algorthym would be to repeat those bytes successively up to the
length of the message:

Encrypt: Decrypt:
A xor k1 = whatever xor k1 = A
T xor k2 = whatever xor k2 = T
T xor k3 = whatever xor k3 = T
A xor k4 = whatever xor k4 = A
C xor k1 = whatever xor k1 = C
K xor k2 = whatever xor k2 = K
etc.

But another (completely different & incompatible) algorithym, is to
feed the 4 key bytes into a "key scheduling algorithym", which produces
an endless stream of new, different bytes to use for the
encryption/decrytion.

As for the basic xor operation:

dim k1 as byte, k2 as byte, k3 as byte
k1 = &h80 ' 80 hex.
k2 = &h04 ' 04 hex.
k3 = (k1 xor k2)
debug.print hex$(k3) ' should be &h84 - &h80 xor &h04.

HTH,
TC (MVP Access)
http://tc2.atspace.com
(off for 2 days)