0

This is a decompile of an .so file, so it originated from C or C++. Can you kindly try to explain to me what this does?

How would one rewrite this into readable code? I don't mind any programming language.

The loop below is strange: I think it is a for loop but it uses a byte during checking... oh no, this is so wrong. There is one thing I am sure, in the function crackMe the *two is actually a byte array.

And what about the ++keep? and (two++)[1]? Can byte minus byte result in (_BYTE *)(two - newByte)?

This is surely a short code but so much to analyse.

unsigned __int8 *__fastcall crackMe(unsigned __int8 *i, _BYTE *two)
{
  _BYTE *newByte; 
  int flag; 
  int rule; 
  _BYTE *rule2; 
  unsigned __int8 *result; 
  int currentNumCopy; 
  int currentNum; 
  int keep; 
  int forCompare; 
  int isFinal; 

  newByte = two + 1;
  flag = (unsigned __int8)*two;
  if ( !*two )
    return i;
  do
    rule = (unsigned __int8)(two++)[1];
  while ( rule );
  rule2 = (_BYTE *)(two - newByte);
  while ( 1 )
  {
    result = i;
    currentNum = *i++;
    currentNumCopy = currentNum;
    if ( !currentNum )
      break;
    if ( currentNumCopy == flag)
    {
      if ( !rule2 )
        return result;
      keep = 0;
      while ( 1 )
      {
        forCompare = (unsigned __int8)newByte[keep];
        isFinal = result[keep + 1];
        if ( !result[keep + 1] || isFinal != forCompare )
          break;
        if ( rule2 == (_BYTE *)++keep )
          return result;
      }
      if ( isFinal == forCompare )
        return result;
    }
  }
  return 0;
}

My attempt to rewrite it in Java, you can rewrite it in C or C++ or C# or Python or any language you prefer:

        byte[] newByte;
        int flag;
        int rule; 
        byte rule2; 
        int result;
        int currentNumCopy; 
        int keep; 
        int forCompare; 
        int isFinal; 

        newByte = two;
        newByte[two.length + 1] = 1; //I am confused, did it convert array to integer then add 1 or add 1 to the end of array?

        ByteBuffer wrapped = ByteBuffer.wrap(two); // big-endian by default
        flag = wrapped.getInt();
        for (int currentNum = 0; currentNumCopy == flag; currentNum++) {
        ??? rule = ?
  • 1
    decompilation is guesswork and there may be wrong guesses post the relevant assembly too for someone to take a shot – blabb Oct 8 '19 at 18:53
  • here u go i.ibb.co/FXwXFhv/asm.png @blabb – Gin May Oct 8 '19 at 18:57
  • it just a function to return a string, correct me if I'm wrong I didn't see it hook any other functions – Gin May Oct 8 '19 at 19:27
  • I guess ida don't know the data type – Gin May Oct 8 '19 at 20:30
  • @ Gin May your link says image not found :( post the disassembly as text here yes from a fleet look it appears it checks two string and returns a,b,or 0 (probably a strcmp function you can also use some emulators like oaksim , visual arm to emulate the code – blabb Oct 10 '19 at 4:45
-1

I guess newByte[two.length + 1] = 1; look like iterate some value in variable two

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.