3

I came across some unusual strings in some embedded SH2A code I'm analyzing....

11 53 54 00 53 55 4E 44 41 59 00 4F 46 00 2E 4F 56 45 4D 42 45 52 . S T . S U N D A Y . O F . . O V E M B E R

Which I realized is just "1st sunday of November" if you subtract 0x20 from each byte, effectively removing the control characters from ASCII. But they're still using a full 8 bits per character (not that subtracting the control characters is enough to drop a bit anyway) so I'm left wondering why they would do it and whether it's something homegrown or just obscure.

  • Even minus control characters it doesn't explain why the ASCII 1 is converted to a . ... also the N of November. That doesn't fit into a scheme that is merely "flattening" all control characters, does it? – 0xC0000022L Dec 10 '18 at 8:40
  • 2
    @0xC0000022L That's not a ., it's a \x11. – user202729 Dec 10 '18 at 10:31
1

the implementations of tolower() , toupper() normally tend to use the addition or subtraction of 0x20 maybe it is some kind of homegrown brew of these functions

here is a msvcrt toLower() pseudo c code from radare2

[0x78b0ccd4]> pdc
function sym.MSVCR100.dll__tolower () {
    //  1 basic blocks

    loc_0x78b0ccd4:

       edi = edi
       push ebp
       ebp = esp
       eax = dword [arg_8h]     //[0x8:4]=-1 ; 8
       eax += 0x20
                                //ebp ; ebp
       return
(break)

}
[0x78b0ccd4]>
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.