Last active
August 5, 2016 02:23
-
-
Save ashquarky/112d5efc003869a7cf9ea011d10a177c to your computer and use it in GitHub Desktop.
My reverse-engineering of a certain ELF thrown at me
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
void (*mystery_func)(int a, int b); //Pointer, OSDynLoad? | |
void (*mystery_func2)(void*) | |
void another_mystery(void* a, void* b, int c, int d); //Built in to app | |
void possible_init_func(...); //Built in, a few bits missing | |
void yet_another_func(int possibly_not_used); | |
int ret, var1, var2, var3, var4; //var3 and var2 have not been set in this function before they are used, var4 isn't actually in memory | |
var1 = 0; //var1 might be global | |
ret = possible_init_func(&var1, other pointers); | |
if (ret >= 0) { //The variables are checked in this order | |
if (var1 != 0) { | |
if (var3 != 0) { | |
if (var2 != 0) { | |
while (1) { //not quite right, did you use for(;;)? | |
mystery_func(0, 0|0xF2CC); | |
if (var2 == 0) { | |
break; | |
} | |
} | |
} | |
var2 = 1; | |
var4 = another_mystery(&var1); | |
//another_mystery sets some condition registers so I'm not actually sure what we're comparing here | |
if (another_mystery_internal > another_mystery_internal2) { | |
while(1) { | |
if (var4 > 0x578) { | |
var4 = 0x578; | |
} | |
ret = mystery_func2(&var3, &var1, var4, 0); | |
//ret is compared up here | |
var4 = ret - var4; | |
&var1 = &var1 + ret; //var1 has been stored as a pointer this whole time so this operation is valid | |
if (ret < 0) { | |
break; | |
} else if (var4 <= 0) { | |
break; | |
} | |
} | |
} | |
var2 = 0; | |
} | |
if (*var1 == 0) { | |
yet_another_func(*var1); //argument is left over from comparison above, may or may not be used | |
} | |
} //Somewhere in here there's a function call that I couldn't fit into a logical if statement. How the heck did you do that? | |
} | |
//Tidy up stack, do crazy C++ things | |
//Return to caller |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment