New answers tagged

0

trying to tackle it with pencil and paper a common pattern pattern noticeable is (int)*(char *)(param_1 + x) which is equivalent to param_1[x] (unsigned char Array access) so if you pass an array like char param_1[] ={ 0,1,2,3,4,5,6,7,8,9,0xa,0xb,0xc,0xd,0xe,0xf}; then the function will multiply param_1[4] * param_1[0xf] and subtract param_1[0xd] or ...


1

Ghidra uses _ before an instruction to designate it is in a branch delay slot – mumbel 18 hours ago by @mumbel


5

The offsets are listed at the top of the function: You can also hover over the local variable name for a few seconds to see a popup with the offset. If you want to permanently disable the variable offset translation, uncheck Markup Stack Variable References under Edit -> Tool Options -> Options -> Listing Fields -> Operands Fields.


0

There are several implementations of python rc4 available in GitHub repositories As Already pointed out You need to Cleanup and Rename all those local_xxx names in the answer above by @Guillaume it seems he is implying the Array Initialization part as KSA and the KSA as PRGA I don't think you have posted the PRGA in your query the Array Initialization part ...


2

As Paweł Łukasik point out, it looks like RC4 indeed. That's especially true for the KSA that you can immediately recognize: local_14 = 0; while (local_14 < 0x100) { local_12c[local_14] = (byte)local_14; local_14 = local_14 + 1; } If you rename the variables by keeping in mind that this is a Key-Scheduling Algorithm, you end up with the ...


Top 50 recent answers are included