For the types of algorithms that we described earlier, if you have the encrypted data, the encryption algorithm, and the secret key, you can easily decrypt the data (which is the purpose of all encryption algorithms); however, if you have the encrypted data (ciphertext) and a piece of the decrypted data, can you still decrypt the remaining parts of the encrypted data?
In X-RAYING, you can brute force the algorithm and its secret key(s) if you have a piece of decrypted data (plaintext), even if you don't know the offset of this plain text data in the whole encrypted blob. It works on almost all the simple algorithms that we described earlier, even with multiple layers of encryption.
For most of the encrypted PE files, the plain text includes strings such as "This program cannot run in DOS mode" or "kernel32.dll", and it can contain an array of null bytes or INT3 (0xCC) bytes.
For malware strings (if they are all encrypted by the same key...
