I’m pretty new to reverse engineering, so bear with me...
I’m trying to get a few
struct definitions (or whatever they’re called) from this one binary. After some time fiddling around with it, I’ve gathered some data I’m pretty sure belongs to the one of the
structs I’m interested in. However, upon closer inspection, I’ve noticed the addresses of these “pieces of data” are scattered all over the place within this binary, instead of being in one contiguous chunk, as a
struct should be.
A quick Google search on this issue suggested it might be happening because of “pointer encryption”, which apparently is more like
xoring than encrypting(?)... and following searches on the topic lead to nothing.
Which leads me to ask this: what exactly is “pointer encryption”? Can it be undone? And, if so, how can I decrypt it?