Dynamic analysis: run 3, end-to-end capture for the decryptor

Setup

• Image base 0x7FF6A9690000. A stale conditional breakpoint at FUN_14003f880, remembered by x64dbg from run 2, was deleted.
• Test files written with savedata, zero-filled: e2e_small.txt (0x3000), e2e_db.sqlite (0x30123, to get a partial last chunk), e2e_big.bin (0x2DC6C0).
• Launch: init "<exe>", "--encryption_path=C:\Users\deadtrace\Desktop\samples -localonly", "<cwd>".
• Breakpoints:
  • 0x140073950 gate;
  • 0x140071620 WMI executor (forced return);
  • 0x1400822c0 Yarrow seed (logged per thread, later tid()==0x16D0);
  • 0x14007b8d0 RSA encrypt;
  • rename.

Execution timeline

| Time | Event | Observation | |—|—|—| | 13:08 | WMI executor | forced return | | 13:08 | seed hit before gate | the RSA context’s own padding seed | | 13:08 | gate | root is C:\Users\deadtrace\Desktop\samples only | | 13:09–13:11 | thread 0x16D0 | seeds 4041234356400, 4087752264900, 4098288588700, 4107556688800; blob shows e2e_big.bin, mode 2, size 0x2DC6C0 | | 13:09–13:11 | thread 0x1068 | seeds 4052181901800, 4069743706800, 4124383156800, 4173625838700; e2e_db.sqlite, mode 0, size 0x30123 | | 13:12–13:13 | thread 0x16D0 (second file) | seeds 4247816085700, 4259498741100, 4277557538300, 4287007536900; e2e_small.txt, mode 1, 50%, size 0x3000 | | 13:14 | process exited on its own | an old log file from an earlier run was also encrypted; shadow copies skipped |

Every blob was cross-checked: its four seeds regenerate exactly the keys sealed in it. The captures are in 06-decryptor/e2e/captures.txt.

Extracting outputs to the host

There is no host↔VM file bridge. Each .akira file was imported into Ghidra as a raw binary (import_file, language x86:LE:64:default, no auto-analysis, folder /decrypt_test), then read with read_memory using a large length. The tool result was saved to disk and parsed on the host. The rebuilt files are byte-identical to the transfer dumps (rechecked when the case folder was built) and are kept as 06-decryptor/e2e/*.akira.

Conclusions

• Real sample output decrypts byte-exact in all three modes via --seeds and --keys.
• recover found all four seeds of each file from a window around them (see 06-decryptor/README.md).
• Seed gaps here (tens to hundreds of ms) are inflated by debugger pauses. The natural gap of an undebugged run has not been measured.
• VM state after the run: new .akira files in the samples folder. Revert recommended.