RC4 Encryption RC4 is a symmetric stream cipher that encrypts data byte by byte rather than in blocks. Under the hood, it consists of two primary phases: the Key-Scheduling Algorithm (KSA), where the key is initialized and permuted in memory, and the Pseudo-Random Generation Algorithm (PRGA), which generates keystream bytes to be XORed with the data. Thanks to its symmetric architecture, the exact same routine is utilized for both encryption and decryption. ...
XOR Encryption In the world of malware development, one of the most critical factors determining the lifespan of your payload is how effectively you can conceal it. If you embed shellcode or a PE file into memory in plain text, static analysis tools and antivirus (AV) signatures will flag it within seconds. This is precisely where payload encryption comes into play. In this post, we will examine the XOR algorithm—one of the most fundamental yet heavily modified encryption techniques in the malware domain. We will start from the basics and progress toward complex, position-dependent rolling structures. ...
ChaCha20 Encryption In this post, I will talk about ChaCha20. Frankly, I thought about how to introduce the topic, but I couldn’t come up with a sensible introductory sentence. Therefore, I prefer to dive straight into the subject. File size and simplicity are everything. There is only one reason we prefer ChaCha20: it is compact, fast, and eliminates the need to write an extra decryption routine. So why do we choose ChaCha20? Because it is exceptionally fast, does not rely on dedicated CPU cryptographic hardware extensions (such as AES-NI), and is far less cumbersome to implement from scratch in C/C++. Furthermore, we use the exact same code for both encryption and decryption, which minimizes the overall stub size of the software. ...