I am currently analyzing a disassembled library file(.so) for in x86. There is a function called
get_random_key and I can't make any sense out of it. It's more than weird and I personally think this is not even allowed due to memory restrictions. Here's the code for it(disassembled with IDA):
sub_685 proc near ; CODE XREF: get_random_keyp mov ecx, [esp+0] retn sub_685 endp public get_random_key get_random_key proc near ; CODE XREF: get_generated_key+15p call sub_685 add ecx, 1AFFh lea eax, [ecx+3Ch] retn get_random_key endp
From what I see here it loads the content on top of the stack, adds 0x1AFF(6911!!) to it and then interprets this as pointer and adds 0x3C to it and returns. It's a fairly small library and it's likely that it's originally written in C. I can't think of ANY code that would produce something like this. In my eyes this results 9/10 times in a segmentation fault. It's a library that gets loaded into an android app via Java and is around 6kb big.
I'm glad for every hint on this function :)