0

I have this piece of code:

.text:00537FDE                 push    offset a3Rrrrrrrrrrrrr ; "3L+ÐÐÐÐÐÐÐÐÐÐÐÐÐ+ÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐøû9\n"
.text:00537FE3                 call    sub_5606A0

Where offset a3Rrrrrrrrrrrrr is:

.text:005379B0 a3Rrrrrrrrrrrrr db '3L+ÐÐÐÐÐÐÐÐÐÐÐÐÐ+ÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐøû9',0Ah,0

The bytes from Hex View of this string:

.text:005379B0  33 C0 C3 90 90 90 90 90  90 90 90 90 90 90 90 90  3L+ÐÐÐÐÐÐÐÐÐÐÐÐÐ
.text:005379C0  C3 90 90 90 90 90 90 90  90 90 90 90 90 90 90 90  +ÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐ
.text:005379D0  E8 EB 39 0A 00 68 C0 79  53 00 68 80 56 6A 00 6A  øû9.hLyS.hÀVj.j

And sub_5606A0:

.text:005606A0 sub_5606A0      proc near               ; CODE XREF: WinMain(x,x,x,x)+223p
.text:005606A0
.text:005606A0 arg_0           = dword ptr  4
.text:005606A0
.text:005606A0                 mov     eax, [esp+arg_0]
.text:005606A4                 mov     dword_8478CC, eax
.text:005606A9                 retn
.text:005606A9 sub_5606A0      endp

What can this encoded string mean?

.text:005379B0 a3Rrrrrrrrrrrrr db '3L+ÐÐÐÐÐÐÐÐÐÐÐÐÐ+ÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐøû9',0Ah,0

Thanks in advance!

Improve this question
4
  • 2
    that is not a string at all notice the first 3 bytes 33 c0 c3 that is epilog pop ebp, retn it is the first argument to the call which is saved to someplace and returned via eax btw 0x90 (NOP opcode should not be shown as kind of D but as some kind of Latin A you may proabaly have a code page issue – blabb Jul 18 '20 at 20:10
  • Thanks! As turned out it is piece of assembler code. – black4 Jul 19 '20 at 19:03
  • @blabb looks like an answer to me. – multithr3at3d Jul 22 '20 at 3:01
  • @multithr3at3d thanks for reminding i have converted it – blabb Jul 22 '20 at 5:16
3

The Sequence of Bytes do not represent a string

please take note of the first 3 bytes 0x33,0xc0,0xc3

These are opcodes for xor eax,eax , retn basically return 0; in c / c++

0:000> eb . 33 c0 c3
0:000> u . l2
ntdll!LdrpDoDebuggerBreak+0x2c:
777a05a6 33c0            xor     eax,eax
777a05a8 c3              ret
0:000>

this is probably a chunk of a function which has many return 0; statements

like if(!a)retun 0; do b= blah(); if(!b) return0; .......

here the compiler might have recognized the repetition
and must have split the part into a seperate piece/chunk as part of optimization.

that said 0x90 aka NOP is shown as some kind of D

.text:005379B0  33 C0 C3 90 90 90 90 90  90 90 90 90 90 90 90 90  3L+ÐÐÐÐÐÐÐÐÐÐÐÐÐ

which indicates it is not probably a normal english locale encoding

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.