The debug/memdump approach worked. Quick howto:
1. get MediaCodeSpeedEdit (i used version 1.1.0.16)
2. unpack the binary of MediaCodeSpeedEdit with RL!deUPX 1.X-2.X
3. get SegDump plugin from Dennis Elser
4. recompile the plugin with the sdk for your ida version and put it in the plugin/ folder of your ida installation
5. load MediaCodeSpeedEdit in ida (i used v5.2)
6. look for:
Code:
seg023:0041E990 loc_41E990: ; CODE XREF: sub_41E880+123j
seg023:0041E990 mov bl, [esi]
seg023:0041E992 imul eax, 6C078965h
seg023:0041E998 mov edx, eax
seg023:0041E99A shr edx, 18h
seg023:0041E99D xor bl, dl
seg023:0041E99F mov [esi], bl
seg023:0041E9A1 inc esi
seg023:0041E9A2 dec ecx
seg023:0041E9A3 jnz short loc_41E990
^ after that section is executed (the loop runs over 2million cycles) the image is decrypted in ram. it is basically doing this:
Code:
a = 1;
for (i=0; i<len; i++)
{
b = data[i];
a = a * 0x6C078965;
b = b % (a >> 24);
data[i] = b;
}
7. follow the ESI address "pointer" to find the section where the image is written to and identify the section (should be fairly large ~ 2MB)
8. use the segdump plugin to dump that section and cut it
