Several years ago a group of malware authors began using code like this:
for (j = 0; j < length; j++)
ptr[j] = (ptr[j] ^ VALUEA) - VALUEB;
for encoding, and this to decode
for (j = 0; j < length; j++)
ptr[j] = (ptr[j] + VALUEB) ^ VALUEA;
I've recently seen this pop up in seemingly legitimate software. This leads me to believe that there is a source for this type of encoding somewhere in the wild. I was wondering if there is a specific name for this type of encoding?