Return to Answer

added 1379 characters in body

Source Link

edited Nov 22, 2021 at 14:16

16.7k
1
15
30

EDIT

these are the offsets in my binary as posted above

00020840: 62f3fdff 42f3fdff 22f3fdff 00f3fdff  b...B...".......
00020850: e0f2fdff b4f2fdff 92f2fdff 70f2fdff  ............p...
00020860: 52f2fdff 41f2fdff 30f2fdff 14f2fdff  R...A...0.......
00020870: f0f1fdff d0f1fdff b0f1fdff 91f1fdff  ................
00020880: 74f1fdff 50f1fdff 23f1fdff 10f1fdff  t...P...#.......
00020890: f0f0fdff d0f0fdff 90f3fdff 00000000  ................

the code based on param_1 value (0 to 16) will jump to the resultant location of script below

LEA      RAX,100422040 
MOVSXD   RDX,dword ptr [RAX + param_1*0x4] 
ADD      RAX,RDX
JMP      RAX

jump addresses

>>> import ghidra
>>> staddr = getMemoryBlock(".rdata").start.add(0x40)
>>> for i in range(0,16,1):
...         hex((currentProgram.getMemory().getInt(staddr.add(i*4)))+ staddr.offset)
... 
'0x1004013a2L'
'0x100401382L'
'0x100401362L'
'0x100401340L'
'0x100401320L'
'0x1004012f4L'
'0x1004012d2L'
'0x1004012b0L'
'0x100401292L'
'0x100401281L'
'0x100401270L'
'0x100401254L'
'0x100401230L'
'0x100401210L'
'0x1004011f0L'
'0x1004011d1L'

switch case 0 to 4 as screen shot

EDIT

these are the offsets in my binary as posted above

00020840: 62f3fdff 42f3fdff 22f3fdff 00f3fdff  b...B...".......
00020850: e0f2fdff b4f2fdff 92f2fdff 70f2fdff  ............p...
00020860: 52f2fdff 41f2fdff 30f2fdff 14f2fdff  R...A...0.......
00020870: f0f1fdff d0f1fdff b0f1fdff 91f1fdff  ................
00020880: 74f1fdff 50f1fdff 23f1fdff 10f1fdff  t...P...#.......
00020890: f0f0fdff d0f0fdff 90f3fdff 00000000  ................

the code based on param_1 value (0 to 16) will jump to the resultant location of script below

LEA      RAX,100422040 
MOVSXD   RDX,dword ptr [RAX + param_1*0x4] 
ADD      RAX,RDX
JMP      RAX

jump addresses

>>> import ghidra
>>> staddr = getMemoryBlock(".rdata").start.add(0x40)
>>> for i in range(0,16,1):
...         hex((currentProgram.getMemory().getInt(staddr.add(i*4)))+ staddr.offset)
... 
'0x1004013a2L'
'0x100401382L'
'0x100401362L'
'0x100401340L'
'0x100401320L'
'0x1004012f4L'
'0x1004012d2L'
'0x1004012b0L'
'0x100401292L'
'0x100401281L'
'0x100401270L'
'0x100401254L'
'0x100401230L'
'0x100401210L'
'0x1004011f0L'
'0x1004011d1L'

switch case 0 to 4 as screen shot

Source Link

created Nov 21, 2021 at 10:02

blabb

16.7k
1
15
30

it appeared to be some sort of switch data since you haven't provided much details I googled for the binary and found one.

:\>file xkbcomp64.exe
xkbcomp64.exe: PE32+ executable (console) x86-64, for MS Windows

:\>certutil -hashfile xkbcomp64.exe MD5 | grep -iv hash
aba2c2755017f4d11bf99964e87f4427

whose .rdata start contains differnt bytes

:\>dumpbin /section:.rdata xkbcomp64.exe
Microsoft (R) COFF/PE Dumper Version 14.16.27045.0
Copyright (C) Microsoft Corporation.  All rights reserved.


Dump of file xkbcomp64.exe

File Type: EXECUTABLE IMAGE

SECTION HEADER #3
  .rdata name
    A7C0 virtual size
   22000 virtual address (0000000100422000 to 000000010042C7BF)
    A800 size of raw data
   20800 file pointer to raw data (00020800 to 0002AFFF)
       0 file pointer to relocation table
       0 file pointer to line numbers
       0 number of relocations
       0 number of line numbers
40600040 flags
         Initialized Data
         RESERVED - UNKNOWN
         RESERVED - UNKNOWN
         Read Only

  Summary

        B000 .rdata

actual data at .rdata start location

:\>xxd -s 0x20800 -g 4 -l 0x100 xkbcomp64.exe
00020800: 63796767 636a2d31 362e646c 6c005f4a  cyggcj-16.dll._J
00020810: 765f5265 67697374 6572436c 61737365  v_RegisterClasse
00020820: 73000000 00000000 00000000 00000000  s...............
00020830: 00000000 00000000 00000000 00000000  ................
00020840: 62f3fdff 42f3fdff 22f3fdff 00f3fdff  b...B...".......
00020850: e0f2fdff b4f2fdff 92f2fdff 70f2fdff  ............p...
00020860: 52f2fdff 41f2fdff 30f2fdff 14f2fdff  R...A...0.......
00020870: f0f1fdff d0f1fdff b0f1fdff 91f1fdff  ................
00020880: 74f1fdff 50f1fdff 23f1fdff 10f1fdff  t...P...#.......
00020890: f0f0fdff d0f0fdff 90f3fdff 00000000  ................
000208a0: 56616c75 65206f66 20257320 6669656c  Value of %s fiel
000208b0: 64206d75 73742062 65206f66 20747970  d must be of typ
000208c0: 65202573 0a004163 74696f6e 20257320  e %s..Action %s
000208d0: 64656669 6e697469 6f6e2069 676e6f72  definition ignor
000208e0: 65640a00 696e7465 67657220 2872616e  ed..integer (ran
000208f0: 67652031 2e2e3829 00000000 00000000  ge 1..8)........

since i could see the pattern you posted at offset 0x40 from start of .rdata i tossed it into ghidra to look if this is referenced somewhere and obviously it is referenced as switch data

 switchD_100401109::switchdataD_100422040     XREF[2]:     FUN_1004010f0:1004010f9(*), 
                                                           FUN_1004010f0:100401102(R)  
   100422040 62 f3 fd ff            uint     FFFDF362h
   100422044 42 f3 fd ff            uint     FFFDF342h
   100422048 22 f3 fd ff            uint     FFFDF322h
   10042204c 00 f3 fd ff            uint     FFFDF300h
   100422050 e0 f2 fd ff            uint     FFFDF2E0h
   100422054 b4 f2 fd ff            uint     FFFDF2B4h

function that is referencing this Switchdata

**************************************************************
                         *                          FUNCTION                          *
                         **************************************************************
                         undefined * __fastcall FUN_1004010f0(uint param_1)
         undefined *       RAX:8          <RETURN>
         uint              ECX:4          param_1
 FUN_1004010f0                                XREF[5]:     FUN_100401410:10040141e(c), 
                                                           FUN_100401570:100401587(c), 
                                                           FUN_100401810:100401827(c), 
                                                           10040373a(c), 10042e03c(*)  
   1004010f0 83 f9 16               CMP      param_1,0x16
   1004010f3 0f 87 f9 02            JA       LAB_1004013f2
             00 00
   1004010f9 48 8d 05 40            LEA      RAX,[switchD_100401109::switchdataD_100422040]        = FFFDF362h
             0f 02 00
   100401100 89 c9                  MOV      param_1,param_1
   100401102 48 63 14 88            MOVSXD   RDX,dword ptr [RAX + param_1*0x4]=>switchD_100401109  = FFFDF362h
   100401106 48 01 d0               ADD      RAX,RDX
 switchD_100401109::switchD
   100401109 ff e0                  JMP      RAX