0

While running Hex-Rays decompiler against an application, Hex-Rays gave the following output:

__int64 v29; // r10 ...  v29 = 0i64;    if( !v28)    v19 = 0;

 do
  {
    v30 = *(_BYTE *)(v29 + 5394926180i64);
    v31 = *(_BYTE *)(v29 + 5394926172i64);
    v32 = *(_BYTE *)(v29 + 5394926184i64);
    v33 = *(_BYTE *)(v29 + 5394926176i64);
    v34 = *(_BYTE *)(v29++ + 5394926224i64);
    v75.m128i_i8[v29 + 15] = v30 ^ v34;
    *((_BYTE *)&v76 + v29 + 3) = v31 ^ *(_BYTE *)(v29 + 5394926227i64);
    *((_BYTE *)&v76 + v29 + 7) = v32 ^ *(_BYTE *)(v29 + 5394926231i64);
    *((_BYTE *)&v76 + v29 + 11) = v33 ^ *(_BYTE *)(v29 + 5394926235i64);
    *((_BYTE *)&v74 + v29 + 15) = v30 ^ *(_BYTE *)(v29 + 5394926239i64);
    v75.m128i_i8[v29 + 3] = v31 ^ *(_BYTE *)(v29 + 5394926243i64);
    v75.m128i_i8[v29 + 7] = v32 ^ *(_BYTE *)(v29 + 5394926247i64);
    v75.m128i_i8[v29 + 11] = v33 ^ *(_BYTE *)(v29 + 5394926251i64);
  }
  while ( v29 < 4 );

I'm confused about the references:

*((_BYTE *)&v76 + v29 + 3) = v31 ^ *(_BYTE *)(v29 + 5394926227i64);
*((_BYTE *)&v76 + v29 + 7) = v32 ^ *(_BYTE *)(v29 + 5394926231i64);
*((_BYTE *)&v76 + v29 + 11) = v33 ^ *(_BYTE *)(v29 + 5394926235i64);
*((_BYTE *)&v74 + v29 + 15) = v30 ^ *(_BYTE *)(v29 + 5394926239i64);

These seem to be well outside the realm of any possible array? Am I missing something?

  • Can you post an assembly code related to one of those offsets ? – w s Nov 20 '17 at 7:23
1

It looks like you're dealing with constant address around 5394926180i64 (0x141900a64) and v29 looks like an index in the array of structures. I'd say that it looks like kind of work with memory mapped registers - I had seen such a things before with various IOT devices ROMs . I'd suggest to do the following:

  • Verify that you have a segment that includes the address. If not - create additional data segment that includes all mentioned addresses.
  • Mark the suspicious number as offsets (just press O on them).

This should cause IDA to threat all these things as offsets in memory.

If this is low level code that deals with hardware directly you'll probably find all segment addresses either in it SDK or in the corresponding datasheet.

  • In this case it isn't low-level code but just a Windows application. – user12321 Nov 20 '17 at 18:25
0

Appears I may have figured it out. In this case, it's just dereferencing offsets from 0 which ultimately point to some data in .rdata. I hadn't realized it until I modified the number representation to hex.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.