# Is there specific name for simple XOR with ADD/SUB encoding?

Several years ago a group of malware authors began using code like this:

for (j = 0; j < length; j++)
ptr[j] = (ptr[j] ^ VALUEA) - VALUEB;


for encoding, and this to decode

for (j = 0; j < length; j++)
ptr[j] = (ptr[j] + VALUEB) ^ VALUEA;


I've recently seen this pop up in seemingly legitimate software. This leads me to believe that there is a source for this type of encoding somewhere in the wild. I was wondering if there is a specific name for this type of encoding?

• Both of these operations are addition. ^ is addition per bit, and + is addition per byte. – user27962 Sep 27 '15 at 0:08
• How about "really bad encryption"? Do VALUEB and VALUEA really never change? – mikeazo Sep 27 '15 at 0:59
• I suspect that malware authors use this as a method to avoid signature-based virus checkers. By cryptographical standards, this is a very weak method; however it may be sufficient to avoid simple-minded checks. – poncho Sep 27 '15 at 1:06
• @mikeazo it is definitely "really bad encryption" but as poncho points out, it is a simple method for defeating basic sig-based detection approaches. the constants typically stay constant between versions of the malware and always stay constant within the binary. – tjac Sep 27 '15 at 1:24
• Obfuscation might fit. – CodesInChaos Sep 27 '15 at 10:06