title: Break XOR type encryption with whole Known text from virus
body: <p>I was hit by a ransomware infection that encrypts the first 512 bytes at the top of the file and puts them at the bottom. Upon looking at the encrypted text it seems to be some type of XOR cipher. I know the whole plain text  of one of the files that was encrypted, so i figured in theory i should be able to xor it to get the key to decrypt the rest of my files. Well i am having a very hard time with this because i don't understand how the creator xor'ed it really. Im thinking he would use a binaryreader to read the first 512 bytes into an array, XOR it, and replace it. But does that mean he XOR'ed it in HEX? or Decimal? Im quite confused at this point, but i believe i am simply missing something.</p>
  
  <p>I have tried Xor Tool with python, and everything it attempts to crack looks like non sense. I also tried a python script called Unxor that you give the known plain text to, but the dump file it outputs is always blank.</p>
  
  <p><strong>Good Header file dump:</strong>
  <a href="https://www.dropbox.com/s/v68qz2qrm6n2yih/good-header.bin" rel="nofollow">Good-Header.bin</a></p>
  
  <p><strong>Encrypted Header file dump:</strong>
  <a href="https://www.dropbox.com/s/wp3y1drwy82sjco/enc_header.bin" rel="nofollow">Enc-Header.bin</a></p>
  
  <p>This may not be the best file example to see the XOR pattern, but its the only file i have that also has the original header 100% before encryption. In other headers where there is more changes the encrypted header changes with it.</p>
  
  <p>Any advice on a method i should try, or application i should use to try and take this further? Thanks so much for your help! </p>
  
  <p>P.S Stackoverflow yelled at me when i tried to post 4 links because im so new, so if you would rather see the hex dumps on pastebin than download the header files, please let me no. The files are in no way malicious, and are only the extracted 512 bytes and not a whole file.</p>