0
__m128i ModuleName;
__m128i ProcName;

ModuleName.m128i_i64[0] = 0x3E4D19089E7D5EDi64;
ModuleName.m128i_i64[1] = 0xD8855EB576AF36A0ui64;
ProcName.m128i_i64[0] = 0x6F80FFFCE583A183i64;
ProcName.m128i_i64[1] = 0xD8855EB576AF36CCui64;

ModuleName = _mm_xor_si128(_mm_load_si128(&ModuleName), ProcName);

Above is a snippet of code from a decompiled program that encodes(?) their strings.

ModuleName.m128i_i8 yields the string that is created in the code.

Is there any method (possibly with IDAPython or just tool already built-in) that can be used to simplify that code snippet into just ModuleName = "ntdll.dll"? (I had to compile a program to simplify it to that string)

If assembly is needed, I'll provide it.

1
  • Do you know the platform, CPU architecture, and used programming language?
    – Robert
    Commented Mar 3 at 11:59

1 Answer 1

1

I am not sure if i understand your query

have you tried simply evaluating the xor in idc prompt

IDC>0x3E4D19089E7D5ED^0x6F80FFFCE583A183

should spit out dec,hex,oct,bin,and ascii outputs as below

7810418696977151086. 
6C642E6C6C64746Eh 
661441346615431072156o 0110110001100100001011100110110001101100011001000111010001101110b 
'ntdll.dl' 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.