Nigel logged into the bastion host at Milford High School. He made sure that the encryption was secure, and then accessed his favorite lab server—the one with the most CPU and video stream processor power. He prepared the files for the decryption process. An alert popped up on one of his open windows: “EPROCESS memory mismatch error.”
Something is hiding in the memory, Nigel thought.
Nigel segregated the portion of memory where the error was coming from.
“Time for Ada!” Nigel said.
“Who’s Ada?” Melissa said.
I forgot she was there! Nigel thought.
“‘Ada’ is short for ‘advanced decompiler algorithm.’ It is a program that will allow me to capture and reverse engineer the bad code trying to infect me,” Nigel said.
If you encounter this tale on Amazon, note that it's taken without the author's consent. Report it.
“Oh!” Melissa said, trying not to show her ignorance.
Once Nigel isolated the malicious code, he launched his decryption process.
Time to see how this is constructed, Nigel thought.
Since the malware had not run yet, Nigel could unpack the malware using a reverse stuffer program. Nigel examined the files, and while there was malicious code in the package, any experienced reverse engineer could detect it. He laid out the files and performed a signature analysis of each file in the package. After checking the tool’s logs, he noticed the following message: “Warning, file rroot.png contains steganography patterns.”
A hidden message!
Nigel’s heart raced. He hadn’t found a file with a hidden message before. He ran his Quick Stego program to view the hidden payload. The ROT-13 encoded message was listed as:
Avtr jr ner ba na vfynaq bss gur pbnfg bs Avtrevn svaq zr jvgu Qrygn, Wrg
Nigel’s heart raced as he read the decoded message; it read: “Nige, we are on an island off the coast of Nigeria. Find me with Delta, Jet.”
“I know where they are!” Nigel screamed.