Could you have set a breakpoint on the function and traced it while it created the new encrypted test image until you could dump the salt from memory?