0

I am trying to understand the following snippet. I understand that the first check would check if it is even if it would be an int, but I don't understand it in this context.

Could someone explain to me what this does?

if (((byte)*password & 1) == 0) {
  buf = password + 1;
  len = (uint)((byte)*password >> 1);
}
else {
  len = *(uint *)(password + 4);
  buf = *(basic_string **)(password + 8);
}

bp = BIO_new_mem_buf(buf,len);
1

Based on this limited amount of psuedo-C:

struct password_buffer {
    byte len:7;
    byte use_pointer:1;
    union {
        byte buffer[128];
        struct {
            byte pad[3];
            uint len;
            char *buf;
        } pointer;
    };
};

This "password" should be probably be treated like a union. That low bit is not odd or even, it's a flag to decide if the password is a buffer or in a pointer.

When the least significant bit is unset in the first byte, then the password is a buffer with the zero index byte containing the length in the high 7 bits followed directly by the password.

When the least significant bit is set in the first byte, then the length is the first uint after this first byte (4-byte aligned) and password is stored in memory with a pointer.

This structure probably will default to the "buffer" when the string is less than 128 characters; otherwise, it will be in other memory with a pointer to the memory and a length value.

structs like this will not cleanly be represented by most decompilation tools. There's just not enough information in the assembly to do so.

1
  • Thanks for the reply. The pseucode code comes from the Ghidra decompiler. Turns out the paramater wasn't password but publicKey.
    – David
    Jul 26 at 13:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.