0

I'm taking part in this reverse engineering lab at college and we have this final big homework project. I have a part of the binary that changes it's own asm code by iterating through it's own bytes and add-ing or maybe xor-ing and then rewriting them back to memory.

I'm stuck at this function that I managed to decompile using x64dbg to the following (variable naming changed by me)

uint8_t fun_401c05(uint8_t argument) {
    uint8_t counter;

    counter = 0;
    if (argument) {
        do {
            counter = (uint8_t)(counter + 1);
            argument = (uint8_t)(argument & (uint8_t)(argument - 1));
        } while (argument);
    }
    return counter;
}

I'm trying to understand what exactly this function does. I know the function is called 3 times, each time with a letter from my input file. Each of the results is then processed using xor and some sar instruction (it's my first time seeing it) to calculate an int key that grants access to the next part of the challenge and I need to understand what the function does in order to give it the right input. I can see what it does but can't really get the meaning of it just yet..

EDIT: I know the name of the question is bad but I have no idea what other generic name to give it. If someone can help I'll be very grateful

3

It counts the number of 1's in argument's binary representation (see link).

Basically, each n & (n - 1) cancels out the least significant 1 in n's binary representation, preserving all more significant digits.

  • Yes, that's right.. I was able to derive my key using your tip. Thanks! – csanonymus May 26 at 18:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.