This year, ransomware has dominated the threat landscape. We have seen various families, showing different attack approaches. Sometimes, the first line of defence fails. Then, the only help can be provided by finding weak points in the ransomware code and writing a decryptor. Depending on which part of the code contains the flaw, there are different challenges - and different approaches to be used in order to accomplish this task. This presentation will discuss some of them, showing real-life examples.