Say i have Windows executable that looks like normal one, but actually has encrypted segments or blocks of code, and the way it calculates key to decrypt itself at run-time way hard for me. I'd like to try create a decrypted version of that program by stripping out self-decryptor part and exporting program as it was at run-time (under debug). I am not looking for way to find & remove decryption-related code.Having IDA Pro (or  other tools), how can i re-save executable file at run-time (after program decrypted itself), or i am thinking in completely wrong direction and should not try doing it?I've read this answer and question but i am wondering if i really cannot just re-save executable at runtime and try to make it runnable? Is this possible?
Create unprotected executable for program that decrypts itself at run-time dynamically?
ida;windows;x86;pe;decryption
If you are dealing with a packed/crypted executable it is not possible to just dump the file from memory and make it runnable. You need to do at least two things:Modify the Entry Point so that you bypass the execution of the code in the unpacking stub.Fix the import table.To do these two things, you need to have some basic understanding about the PE file format. You can find some useful links about the PE file format in this answer.If you know what type of crypter/packer is being used on the file, feel free to upload the sample or tell me so I can maybe give you some guidelines on obtaining the payload. You can check this with a tool like PEid or ExeInfo.