Auroras' idea seems very similar to what the self-encryption/decryption algorithm MoleBox used: Basically, when the packer decrypts an instruction block before executing and encrypts the block again after execution.
Therefore, the file is never fully decrypted in memory.
|