New answers tagged


trying to tackle it with pencil and paper a common pattern pattern noticeable is (int)*(char *)(param_1 + x) which is equivalent to param_1[x] (unsigned char Array access) so if you pass an array like char param_1[] ={ 0,1,2,3,4,5,6,7,8,9,0xa,0xb,0xc,0xd,0xe,0xf}; then the function will multiply param_1[4] * param_1[0xf] and subtract param_1[0xd] or ...


Ghidra uses _ before an instruction to designate it is in a branch delay slot – mumbel 18 hours ago by @mumbel


The offsets are listed at the top of the function: You can also hover over the local variable name for a few seconds to see a popup with the offset. If you want to permanently disable the variable offset translation, uncheck Markup Stack Variable References under Edit -> Tool Options -> Options -> Listing Fields -> Operands Fields.


There are several implementations of python rc4 available in GitHub repositories As Already pointed out You need to Cleanup and Rename all those local_xxx names in the answer above by @Guillaume it seems he is implying the Array Initialization part as KSA and the KSA as PRGA I don't think you have posted the PRGA in your query the Array Initialization part ...


As Paweł Łukasik point out, it looks like RC4 indeed. That's especially true for the KSA that you can immediately recognize: local_14 = 0; while (local_14 < 0x100) { local_12c[local_14] = (byte)local_14; local_14 = local_14 + 1; } If you rename the variables by keeping in mind that this is a Key-Scheduling Algorithm, you end up with the ...

Top 50 recent answers are included