0

I have code that looks like this:

byte_100031BA4 = v41;
byte_100031BA5 ^= 0x3Eu;
byte_100031BA6 ^= 0x47u;
LOBYTE(a1) = -9;
byte_100031BA7 ^= 0xF7u;
byte_100031BA8 ^= 0xA9u;
byte_100031BA9 ^= 0xE8u;
byte_100031BAA ^= 0x5Eu;
byte_100031BAB ^= 0x7Fu;
byte_100031BAC ^= 0x33u;
LOBYTE(a2) = 116;
byte_100031BAD ^= 0x74u;
byte_100031BAE ^= 0x78u;
byte_100031BAF ^= 0xFAu;
xmmword_100031B80 = (__int128)_mm_xor_ps((__m128)xmmword_100031B80, (__m128)xmmword_10002E1C0);
byte_100031B90 ^= 0x8Bu;
byte_100031B92 ^= 0xD5u;
byte_100031B93 ^= 0x53u;
byte_100031B94 ^= 0x9Bu;
byte_100031B95 ^= 0x16u;
byte_100031B96 ^= 0x18u;

I want to use IDA Python to run on each line of code and if it starts with 'byte_' and has '^=' in it then do for me the or and show the 'decrypted value' in a comment.

How can I do this?

0

the output you posted doesn't seem to be disassembly but PseudoCode
I am not sure if you want your pseudo Code Commented or Disassembly Commented
below is an approach to Comment the Disassembly using the built-in idc on Ida Free 7

iirc you can run idc from python (ida free doesn't support either pseudo code or python so I cant be sure )

the disassembly look like this prior to using the script

.data:0000000140023898 byte_140023898  db 0
.data:0000000140023899 byte_140023899  db 0
.data:000000014002389A byte_14002389A  db 0

script is along these lines entered an executed using shift+f2 or file->scriptCommand

auto addr,byteat,xorred;
addr = ask_addr(0,"enter an Address");
Message("you entered %x\n",addr);
byteat = get_db_byte(addr);
Message("byte at Address is %x\n",byteat);
Message("xorring byte with 0x3E\n");
xorred = byteat ^ 0x3e;
Message("result of xor = %x\n" , xorred);
Message("Setting Comment\n");
set_cmt(addr,sprintf("xorred result is %x\n",xorred),0); 

after execution these messages will be seen in the Output Window

you entered 140023898
byte at Address is 0
xorring byte with 0x3E
result of xor = 3e
Setting Comment

and the commented disassembly will look like

.data:0000000140023898 byte_140023898  db 0                    ; xorred result is 3e
.data:0000000140023898                                         ;
.data:0000000140023899 byte_140023899  db 0
.data:000000014002389A byte_14002389A  db 0
| improve this answer | |
0

A decompiler plugin can be made to apply xor operations automatically. Please check this blog post for more info and sample code.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.