0

I am currently analyzing a disassembled library file(.so) for in x86. There is a function called get_random_key and I can't make any sense out of it. It's more than weird and I personally think this is not even allowed due to memory restrictions. Here's the code for it(disassembled with IDA):

sub_685     proc near       ; CODE XREF: get_random_keyp
    mov ecx, [esp+0]
    retn
sub_685     endp

public get_random_key
get_random_key  proc near       ; CODE XREF: get_generated_key+15p
    call    sub_685
    add ecx, 1AFFh
    lea eax, [ecx+3Ch]
    retn
get_random_key  endp

From what I see here it loads the content on top of the stack, adds 0x1AFF(6911!!) to it and then interprets this as pointer and adds 0x3C to it and returns. It's a fairly small library and it's likely that it's originally written in C. I can't think of ANY code that would produce something like this. In my eyes this results 9/10 times in a segmentation fault. It's a library that gets loaded into an android app via Java and is around 6kb big.

I'm glad for every hint on this function :)

6
  • This isn't really on point, but since I can't comment or send a private message this will have to do. If it's about deciphering this library just for the sake of it, this comment won't be helpful. If you just want to gain access to that App-API attach a debugger to the Android App, call the native function and catch the response (use IntelliJ's "Evaluate Expression" window while in debug mode). Happy Jodeling ;) – Nils Borrmann May 2 '16 at 20:37
  • Then I'm obviously not the first one trying this :P... would love to hear what you found out. And I know there are kinda easier ways. Even recompiling the library, integrate it into another program and just taking what it does but I always wanted to dig a bit into assembly so I'll keep finding the most elegant way even if its not the fastest :) – SkryptX May 2 '16 at 21:37
  • I didn't really try to decompile the file and only had a brief look at the disassembly, as I don't have any experience with that. It's probably mostly XOR'ing stuff with other stuff. Maybe try attaching a debugger? I might play a bit with it in the future, hit me up if you find out anything. – Nils Borrmann May 2 '16 at 22:23
  • It's actually pretty hard to use a debugger on a Android App that isn't compiled with Debug and uses native code... I will look if I can get the library to work as a seperate piece of code. Currently the ELF Headers don't match for x86/x64 execution so I try to circumvent that :) – SkryptX May 2 '16 at 22:35
  • I used apktool with the -d option to get a debuggable apk (that will change the app signature though hint hint), native code wasn't an issue. I could just call that generate function with any string and get the output. Just calling into the library should be possible too. Maybe we should move this discussion to IRC or something? – Nils Borrmann May 2 '16 at 22:55
3

This looks like an attempt by the compiler to generate position independent code (PIC). The call to sub_685 gets the address of the instruction after the call into ecx. The 1AFF is probably the offset from that instruction to the data segment, and 3C is the address of the variable in the data segment. Or, 1AFF is the offset to a structure, and 3C the offset to a member of that structure.

1
  • It was actually the case. I made quite a bit of progress on my disassembly and almost fully understand it now :) What was probably the most confusing in the first place was the "random" as name since it just loads a static array of 40 bytes... – SkryptX May 13 '16 at 23:23
2
0x401000    call    sub_685      call will return 0x401005 the return address 
0x401005    add ecx, 1AFFh       ecx will be  0x401005+0x1aff = 0x402b04
0x401xxx    lea eax, [ecx+3Ch]   lea doesnt deref it will just add 3c 
                                 to ecx so eax will be 402B04 assuming the
                                 call sub_685 was at address 0x401000** 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.