1

I have the following two lines:

  ....
  push 401150h
  call sub_401253
  ....

So, when I click on push 401150h IDA PRO shows:

  seg0001 : 00401120 dword_401120  dd  6F662F3Ch, 3C3E746Eh, 3E702Fh, 253A4E52h, 54522073h
  dd 2073253Ah, 73253A55h, 253A5020h, 656C774h, 616223Dh, 72676B63h, 646E756Fh
  dd 0D73h, 7320703Ch, 335504h, 7265464h, 5484531h 55E4ADEh, A585B5448h, 
  .....(and so on)

So, my first question would be : what is this? what it can be?

My own results: that thing which I mentioned above is a string because in the function sub_401253 they copy it using lstrcpy() into a buffer:

 ...
 lea eax, [esp+1FC + Buffer]
 ...
 mov edi, [esp+208+arg_0]
 push edi, 
 push eax, 
 call lstrcpy
 ...

After that, in a next block the content of the buffer(which are the hexadecimal numbers now) is XORed in a loop. I assume that they encrypt or decrypt it (but that is not so importan for me right now.)

I only want to know what IDA PRO try to depict with push 401150h which represents the hexadecimal numbers. Thats it. I hope you can help me.

best regards,

8

The data at 00401120 is ASCII-encoded text:

3C 2F 66 6F 6E 74 3E 3C 2F 70 3E 00 52 4E 3A 25        </font></p>.RN:%
73 20 52 54 3A 25 73 20 55 3A 25 73 20 50 3A 25        s RT:%s U:%s P:%
77 6C 65 00 3D 22 62 61 63 6B 67 72 6F 75 6E 64        wle.="background
73 0D 00 00                                            s...

You can tell IDA to decode those bytes as text by clicking on the data at 00401120 and pressing the A key

  • ok, since I know that the XOR-key is 0A1h, then I must XOR 0A1h with 3C and so on to get the decrypted info...right? – user3097712 Oct 3 '14 at 15:41
  • The data above is already in plaintext (not encrypted), so the XOR would apparently be used to encrypt that data. But yes, if it's a single byte key of A1, then you'd XOR each byte in the string with A1 to see what the XOR'ed result would be. – Jason Geffner Oct 3 '14 at 15:47
  • ok, thx for your perfect answer. – user3097712 Oct 3 '14 at 16:23
  • 1
    You would have spotted this if you had looked at the Hex+ASCII display of your code. – Paddywhacker Oct 4 '14 at 10:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.