New answers tagged ghidra
0
trying to tackle it with pencil and paper
a common pattern pattern noticeable is
(int)*(char *)(param_1 + x) which is equivalent to param_1[x] (unsigned char Array access)
so if you pass an array like
char param_1[] ={ 0,1,2,3,4,5,6,7,8,9,0xa,0xb,0xc,0xd,0xe,0xf};
then the function will multiply param_1[4] * param_1[0xf] and subtract param_1[0xd]
or ...
1
Ghidra uses _ before an instruction to designate it is in a branch delay slot – mumbel 18 hours ago by @mumbel
5
The offsets are listed at the top of the function:
You can also hover over the local variable name for a few seconds to see a popup with the offset.
If you want to permanently disable the variable offset translation, uncheck Markup Stack Variable References under Edit -> Tool Options -> Options -> Listing Fields -> Operands Fields.
0
There are several implementations of python rc4 available in GitHub repositories
As Already pointed out You need to Cleanup and Rename all those local_xxx names
in the answer above by @Guillaume it seems he is implying the Array Initialization part as KSA and the KSA as PRGA
I don't think you have posted the PRGA in your query
the Array Initialization part ...
2
As Paweł Łukasik point out, it looks like RC4 indeed.
That's especially true for the KSA that you can immediately recognize:
local_14 = 0;
while (local_14 < 0x100) {
local_12c[local_14] = (byte)local_14;
local_14 = local_14 + 1;
}
If you rename the variables by keeping in mind that this is a Key-Scheduling Algorithm, you end up with the ...
Top 50 recent answers are included
