0

This is a decompile of an .so file, so it originated from C or C++. Can you kindly try to explain to me what this does?

How would one rewrite this into readable code? I don't mind any programming language.

The loop below is strange: I think it is a for loop but it uses a byte during checking... oh no, this is so wrong. There is one thing I am sure, in the function crackMe the *two is actually a byte array.

And what about the ++keep? and (two++)[1]? Can byte minus byte result in (_BYTE *)(two - newByte)?

This is surely a short code but so much to analyse.

unsigned __int8 *__fastcall crackMe(unsigned __int8 *i, _BYTE *two)
{
  _BYTE *newByte; 
  int flag; 
  int rule; 
  _BYTE *rule2; 
  unsigned __int8 *result; 
  int currentNumCopy; 
  int currentNum; 
  int keep; 
  int forCompare; 
  int isFinal; 

  newByte = two + 1;
  flag = (unsigned __int8)*two;
  if ( !*two )
    return i;
  do
    rule = (unsigned __int8)(two++)[1];
  while ( rule );
  rule2 = (_BYTE *)(two - newByte);
  while ( 1 )
  {
    result = i;
    currentNum = *i++;
    currentNumCopy = currentNum;
    if ( !currentNum )
      break;
    if ( currentNumCopy == flag)
    {
      if ( !rule2 )
        return result;
      keep = 0;
      while ( 1 )
      {
        forCompare = (unsigned __int8)newByte[keep];
        isFinal = result[keep + 1];
        if ( !result[keep + 1] || isFinal != forCompare )
          break;
        if ( rule2 == (_BYTE *)++keep )
          return result;
      }
      if ( isFinal == forCompare )
        return result;
    }
  }
  return 0;
}

My attempt to rewrite it in Java, you can rewrite it in C or C++ or C# or Python or any language you prefer:

        byte[] newByte;
        int flag;
        int rule; 
        byte rule2; 
        int result;
        int currentNumCopy; 
        int keep; 
        int forCompare; 
        int isFinal; 

        newByte = two;
        newByte[two.length + 1] = 1; //I am confused, did it convert array to integer then add 1 or add 1 to the end of array?

        ByteBuffer wrapped = ByteBuffer.wrap(two); // big-endian by default
        flag = wrapped.getInt();
        for (int currentNum = 0; currentNumCopy == flag; currentNum++) {
        ??? rule = ?
  • decompilation is guesswork and there may be wrong guesses post the relevant assembly too for someone to take a shot – blabb Oct 8 at 18:53
  • here u go i.ibb.co/FXwXFhv/asm.png @blabb – Gin May Oct 8 at 18:57
  • it just a function to return a string, correct me if I'm wrong I didn't see it hook any other functions – Gin May Oct 8 at 19:27
  • I guess ida don't know the data type – Gin May Oct 8 at 20:30
  • @ Gin May your link says image not found :( post the disassembly as text here yes from a fleet look it appears it checks two string and returns a,b,or 0 (probably a strcmp function you can also use some emulators like oaksim , visual arm to emulate the code – blabb Oct 10 at 4:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.