2

while I'm doing RE using ghidra i saw this code

  byte bVar1;
  byte bVar2;
  uint uVar3;
  
  uVar3 = 0;
  while (bVar2 = (byte)uVar3, (char)bVar2 < '\b') {
    bVar1 = *(byte *)(uVar3 + param_1) ^ *(byte *)(uVar3 + param_2);
    *(byte *)(uVar3 + param_1) = (bVar1 << (bVar2 & 7) | bVar1 >> 8 - (bVar2 & 7)) - bVar2;
    uVar3 = (uint)(byte)(bVar2 + 1);
  }
  return;

i know the code rotate shift but i don't think it's the same i know it's kinda diffrent here not a simple bit movement

so write a python code will make the bit-roll here make sense

1
  • FlareOn 2021 - UnlockYourFiles :) Sep 14, 2021 at 17:58

1 Answer 1

1

This code can be cleaned up to be a bit more readable

void __cdecl decrypt(char *dst,char *src)
{
  byte j;
  uint i;

  i = 0;
  while (j = (byte)i, (char)j < 8) {
    dst[i] = ((dst[i] ^ src[i]) << (j & 7) | (byte)(dst[i] ^ src[i]) >> 8 - (j & 7)) - j;
    i = (uint)(byte)(j + 1);
  }
  return;
}

But the shifting and or-ing still might be confusing. In this case, it's easer to look at disassembly than the decomplication and if you would do that the operations that constitutes for loop body are xor, rol and sub. So the shifting and or is pseudo-code for assembly rol opcode.

And it can be implemented by a simple lambda

rol = lambda val, r_bits, max_bits: \
    (val << r_bits%max_bits) & (2**max_bits-1) | \
    ((val & (2**max_bits-1)) >> (max_bits-(r_bits%max_bits)))

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.