While definitely not common, it is possible to either decrypt the sample in the same section that it was originally located (this section should have write permissions) or in another section of an original file.
In this case, it makes sense to perform the following steps:
- Search for a big encrypted block (usually, it has high entropy and is visible to the naked eye in a hex editor).
- Find the exact place where it will be read (the first bytes of the block may serve other purposes—for example, they might store various types of metadata, such as sizes or checksums/hashes, to verify the decryption).
- Put a breakpoint on read and/or write there.
- Run the program and wait for the breakpoint to be triggered.
As long as this block is accessed by the decryption routine, it is pretty straightforward to get the decrypted version of it—either by placing a breakpoint on execution at the end of the decryption function or a breakpoint on write to...
