Some tools have been written to help malware researchers use the X-RAYING technique for scanning. The following are some of these tools that you can use, either from the command line or by using a script:
- XORSearch: This is a tool that was created by Didier Stevens, and it searches inside ciphertext by using a given plain text sample to search for. It doesn't only cover xor—it also covers other algorithms, including bit shifting (such as rol, ror):
Figure 25: XORSearch UI
- Yara Scanner: Yara is a static signature tool that helps scan files with predefined signatures. It allows regex, wildcard, and other types of signatures. It also allows xor signatures:
Figure 26: Example of using a YARA signature
Unfortunately, these tools are only created for xor encryption algorithms. For more advanced X-RAYING techniques, you may need to write a small script to scan with manually.
