I am having some trouble understanding what this is doing.

This is the commented pseudocode.

mightGetUserInput(&std::__1::cin, &userInput) ; this fills the buffer with the user input, naming is a bit weird, but I'm not sure how to improve it?

if ( userInput & 1 ) ; wtf is this doing? IDA flags userInput as _BYTE
  v54 = &userInput;  // 
  v55 = &userInput;  // This is literally junk. Has no use. Would be nice to clean this up but how?
  v56 = &userInput;  //
  length_of_userInput = *((_QWORD *)&userInput + 1); I have been able to only trigger this
  v51 = &userInput;  //
  v52 = &userInput;  // This is literally junk. Has no use. Would be nice to clean this up but how?
  v53 = &userInput;  //
  length_of_userInput = (signed int)userInput >> 1; No clue what this is doing

This is the actual assembly if you prefer it:

mov     [rbp+user_input], rcx
mov     rcx, [rbp+user_input]
movzx   edx, byte ptr [rcx]
and     edx, 1
cmp     edx, 0
jz ....

EDIT: Someone in the comments asked for the disassembly of mightGetUserInput: here it is. DISCLAIMER: This is the pseudocode generated by IDA. It's pretty ugly and big.

I don't really know the size of userInput. It's either referred as void * or as __int64. If this is wrong (and can guide me through IDA, feel free to correct me).

  • Can you give the size of the var userInput and the disassembly of mightGetUserInput. I would say the original code should be something like: int userInput; std::cin >> userInput; if (userInput & 1) {...} else {...}
    – wisk
    Mar 1 '19 at 19:12
  • @wisk I added everything in the post. Mar 1 '19 at 20:03

At it's most basic level, this code piece checks if the lowest bit of a given variable is set. As mentioned, one possibility is that this code checks if the variable is a even number.

Another option (which to me seems more reasonable given the limited context provided), is that the least significant bit is used as a flag/bit-field to signify the state of a value.

Several commonly seen options are:

  1. specifying whether something is initialized.
  2. what's the type of the value; either a string or an integer, for example. This can be seen in Javascript VMs, for example. To avoid storing an additional field.
  3. An encoding of variable length values. ASN1, for example, encodes it's variable-length length fields dedicating a bit to whether this is the last byte of the length field.

it may be a check for odd numbers

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.