func_2476e15e57ddb2b4和 上一个版本的func_173e8124cdbdc90d应该是类似的?
在sub_C5E3(DanmakuStructTag*, int, char**, char**)里调用时把key固定成了
a1 1c f6 17 58 34 48 37 24 25
求问有没有动态分析的方法?
静态分析:
str2 = L__ZZ8sub_C5E3P16DanmakuStructTagiPPcS2_E3C_2E_2
str3 = L__ZZ8sub_C5E3P16DanmakuStructTagiPPcS2_E3C_2E_3
func_2476e15e57ddb2b4(key, str2, 32)
func_2476e15e57ddb2b4(key, str3, 32)
AES_decrypt(rid, ebp-33, ebp-66, ebp-166)
//ebp-33: modified str2?
//ebp-66: modified str3?
//ebp-166: size 100 buf, output ptr?
snprintf(v6, 499, "%d%s%lld%s%s", rid, did, tt, "1000", aes_output)
Func_86C8982CCCC5E7A0(rid, v6, len(v6), buf)
md5的K表还是像之前一样ff hh +1 gg ii -1
不知道正确率如何
新东西估计主要在这个EncodeFlashMain::EncodeDataC
cpp的,有个全局的初始化,生成80+1字节的bss seg,然后再根据rid的值用一组4 bytes bss和一个_EncodeFlashMain::DecodeFlashMain_0[0-4][0-9](unsigned char*, int, IDataCache*)函数去算最后的encode,这种函数有50个,反向出来的代码量该有多少……
ptr2fun mapping:
modFunStart:int = CModule.allocFunPtrs(modPkgName,416,4);
_EncodeFlashMain::InitialCache() modFunStart + 0
__GLOBAL__I_EncodeFlashMain::InitialCache():int modFunStart + 4
_EncodeFlashMain::EncodeFlashMain_000(unsigned char*, int, IDataCache*):int modeFunStart + 8
_EncodeFlashMain::DecodeFlashMain_000(unsigned char*, int, IDataCache*) modFunStart + 12
_EncodeFlashMain::EncodeFlashMain_001(unsigned char*, int, IDataCache*):int modFunStart + 16
_EncodeFlashMain::DecodeFlashMain_001(unsigned char*, int, IDataCache*) modFunStart + 20
...
_EncodeFlashMain::EncodeFlashMain_049(unsigned char*, int, IDataCache*):int modFunStart + 400
_EncodeFlashMain::DecodeFlashMain_049(unsigned char*, int, IDataCache*) modFunStart + 404
_EncodeFlashMain::DecodeDataC(unsigned char, unsigned char*, unsigned short):int modFunStart + 408
_EncodeFlashMain::EncodeDataC(unsigned char, unsigned char*, unsigned short):int modFunStart + 412