Продолжаю тему реверса алгоритма, ссылка на первую статью https://habr.com/ru/articles/1064990/. В этой части доведу реверс до конца, постараюсь показать как делать не надо, почему декомпиляция хорошо, а эмуляция лучше )
Мы остановились на процедурке sub_1DBE83C, по предварительному анализу она вызывается за весь код 2 раза:
Первый раз с параметрами (dest = 0x3c, source = 50, всего = x0x10),
C этим блоком делается SHA-1 (dest=0x10, source=0x3c, всего = x0x10),
Второй вызов (куда=0x0, откуда=0x10, всего = x0x10)
ROM:01DBE83C sub_1DBE83C ; CODE XREF: sub_1D853D0+8Cp ROM:01DBE83C ; sub_1D853D0+C8p ... ROM:01DBE83C ROM:01DBE83C var_9C = -0x9C ROM:01DBE83C var_8C = -0x8C ROM:01DBE83C ROM:01DBE83C STMFD SP!, {R4,R5,LR} ROM:01DBE840 SUB SP, SP, #0xA0 ; свой блок данных размером 0xA0 ROM:01DBE844 MOV R4, R1 ROM:01DBE848 LDR R1, =0x2105B04 ; тут лежат константы ROM:01DBE84C MOV R5, R0 ROM:01DBE850 LDMIA R1, {R1,R3,R12,LR} ROM:01DBE854 ADD R0, SP, #0x10 ROM:01DBE858 STMIA R0, {R1,R3,R12,LR} ; запишем себе ROM:01DBE85C LDR R1, =0x2105B14 ; и тут константы ROM:01DBE860 MOV R0, SP ROM:01DBE864 LDMIA R1, {R1,R3,R12,LR} ROM:01DBE868 STMIA R0, {R1,R3,R12,LR} ; Покажу их сразу в стеке ROM:01DBE86C ADD R1, SP, #0x20 ROM:01DBE870 ADD R0, SP, #0x10 ROM:01DBE874 BL sub_1DBC554 ; первая процедура ROM:01DBE878 ADD R2, SP, #0x20 ROM:01DBE87C MOV R1, R4 ROM:01DBE880 MOV R0, R5 ROM:01DBE884 BL sub_1DBCEF0 ; вторая процедура ROM:01DBE888 ADD SP, SP, #0xA0 ROM:01DBE88C LDMFD SP!, {R4,R5,PC} ROM:01DBE88C ; End of function sub_1DBE83C
Код выделяет блок памяти размером 0xa0, заполняет начальные данные константами, далее вызываются 2 процедуры: sub_1DBC554 и sub_1DBCEF0. С разбора sub_1DBC554 и начнем. Постараюсь писать коротко, чтобы не копировать листинги после каждого решения.
Первое что нужно сделать - подготовить эмулятор, установить точку останова на начало функциии, запустить.
Bathfile такой же, только меняем точку останова:
b:: reset system.option.bigendian on system.up data.load.binary "kernel.bin" 0x1B60000 data.set 0x50 %BYTE 0x11 data.set 0x51 %BYTE 0x22 data.set 0x52 %BYTE 0x33 data.set 0x53 %BYTE 0x44 data.set 0x54 %BYTE 0x55 data.set 0x55 %BYTE 0x66 data.set 0x56 %BYTE 0x90 data.set 0x57 %BYTE 0x1B register.set.pc 0x203D5D8 b.s 0x01DBC554 go
Выделил в стеке начальные загруженные константы.
Не уверен, что нужно было приводить целиком, портянка на 600 строк, без ветвлений.
Листинг функции sub_1DBC554 из IDA
sub_1DBC554 STMFD SP!, {R4-R10,LR} LDRB R5, [R0] LDRB R4, [R0,#2] LDRB R6, [R0,#1] LDRB R7, [R0,#3] ADD R0, R5, R4 ADD R2, R0, #0x47 ADD R2, R2, #0x8600 ADD R2, R2, #0x1C80000 ADD R2, R2, #0x60000000 LDR LR, =0x224C2F4 ;tab1 AND R0, R2, #0xFF LDR R8, [LR,R0,LSL#2] MOV R0, #0xFF LDR R12, =0x224C6F4 ;tab2 AND R3, R0, R2,LSR#8 LDR R3, [R12,R3,LSL#2] AND R9, R0, R2,LSR#16 EOR R8, R8, R3 LDR R3, =0x224CAF4 ;tab3 LDR R9, [R3,R9,LSL#2] EOR R9, R8, R9 MOV R8, R2,LSR#24 LDR R2, =0x224CEF4 ;tab4 LDR R8, [R2,R8,LSL#2] EOR R8, R9, R8 STR R8, [R1] ; готово первое значение SUB R8, R6, R7 ADD R8, R8, #0xB9 SUB R8, R8, #0x8700 SUB R8, R8, #0x1C80000 ADD R8, R8, #0xA0000000 AND R9, R8, #0xFF LDR R10, [LR,R9,LSL#2] AND R9, R0, R8,LSR#8 LDR R9, [R12,R9,LSL#2] EOR R9, R10, R9 AND R10, R0, R8,LSR#16 LDR R10, [R3,R10,LSL#2] MOV R8, R8,LSR#24 LDR R8, [R2,R8,LSL#2] EOR R9, R9, R10 EOR R8, R9, R8 STR R8, [R1,#4] ;второе, запись 0x4 MOV R8, R5 MOV R5, R5,LSR#8 ORR R5, R5, R6,LSL#24 MOV R6, R6,LSR#8 ORR R6, R6, R8,LSL#24 ADD R8, R5, R4 ADD R8, R8, #0x8D ADD R8, R8, #0x10C00 ADD R8, R8, #0x3900000 ADD R8, R8, #0xC0000000 AND R9, R8, #0xFF LDR R10, [LR,R9,LSL#2] AND R9, R0, R8,LSR#8 LDR R9, [R12,R9,LSL#2] EOR R10, R10, R9 AND R9, R0, R8,LSR#16 LDR R9, [R3,R9,LSL#2] MOV R8, R8,LSR#24 LDR R8, [R2,R8,LSL#2] EOR R9, R10, R9 EOR R8, R9, R8 STR R8, [R1,#8] ;запись 0x8 SUB R8, R6, R7 SUB R8, R8, #0x8D SUB R8, R8, #0x10C00 SUB R8, R8, #0x3900000 ADD R8, R8, #0x40000000 AND R9, R8, #0xFF LDR R10, [LR,R9,LSL#2] AND R9, R0, R8,LSR#8 LDR R9, [R12,R9,LSL#2] EOR R9, R10, R9 AND R10, R0, R8,LSR#16 LDR R10, [R3,R10,LSL#2] MOV R8, R8,LSR#24 LDR R8, [R2,R8,LSL#2] EOR R9, R9, R10 EOR R8, R9, R8 STR R8, [R1,#0xC] ;запись 0xc MOV R8, R4 MOV R4, R4,LSL#8 ORR R4, R4, R7,LSR#24 MOV R7, R7,LSL#8 ORR R7, R7, R8,LSR#24 ADD R8, R5, R4 ADD R8, R8, #0x8000001A ADD R8, R8, #0x1900 SUB R8, R8, #0xDE0000 ADD R8, R8, #0x8000000 AND R9, R8, #0xFF LDR R10, [LR,R9,LSL#2] AND R9, R0, R8,LSR#8 LDR R9, [R12,R9,LSL#2] EOR R10, R10, R9 AND R9, R0, R8,LSR#16 LDR R9, [R3,R9,LSL#2] MOV R8, R8,LSR#24 LDR R8, [R2,R8,LSL#2] EOR R9, R10, R9 EOR R8, R9, R8 STR R8, [R1,#0x10] ;запись 0x10 SUB R8, R6, R7 ADD R8, R8, #0xE6 ADD R8, R8, #0xE600 ADD R8, R8, #0xDD0000 ADD R8, R8, #0x78000000 AND R9, R8, #0xFF LDR R10, [LR,R9,LSL#2] AND R9, R0, R8,LSR#8 LDR R9, [R12,R9,LSL#2] EOR R10, R10, R9 AND R9, R0, R8,LSR#16 LDR R9, [R3,R9,LSL#2] MOV R8, R8,LSR#24 LDR R8, [R2,R8,LSL#2] EOR R9, R10, R9 EOR R8, R9, R8 STR R8, [R1,#0x14] ;запись 0x14 MOV R8, R5,LSR#8 ORR R8, R8, R6,LSL#24 MOV R6, R6,LSR#8 ORR R5, R6, R5,LSL#24 ADD R6, R8, R4 ADD R6, R6, #0x234 ADD R6, R6, #0x43000 ADD R6, R6, #0xE400000 AND R9, R6, #0xFF LDR R10, [LR,R9,LSL#2] AND R9, R0, R6,LSR#8 LDR R9, [R12,R9,LSL#2] EOR R10, R10, R9 AND R9, R0, R6,LSR#16 LDR R9, [R3,R9,LSL#2] MOV R6, R6,LSR#24 LDR R6, [R2,R6,LSL#2] EOR R9, R10, R9 EOR R6, R9, R6 STR R6, [R1,#0x18] ;запись 0x18 SUB R6, R5, R7 SUB R6, R6, #0x234 SUB R6, R6, #0x43000 SUB R6, R6, #0xE400000 AND R9, R6, #0xFF LDR R10, [LR,R9,LSL#2] AND R9, R0, R6,LSR#8 LDR R9, [R12,R9,LSL#2] EOR R10, R10, R9 AND R9, R0, R6,LSR#16 LDR R9, [R3,R9,LSL#2] MOV R6, R6,LSR#24 LDR R6, [R2,R6,LSL#2] EOR R9, R10, R9 EOR R6, R9, R6 STR R6, [R1,#0x1C] ;запись 0x1c MOV R6, R4,LSL#8 ORR R6, R6, R7,LSR#24 MOV R7, R7,LSL#8 ORR R4, R7, R4,LSR#24 ADD R7, R8, R6 ADD R7, R7, #0x67 ADD R7, R7, #0x6400 SUB R7, R7, #0x3780000 ADD R7, R7, #0x20000000 AND R9, R7, #0xFF LDR R10, [LR,R9,LSL#2] AND R9, R0, R7,LSR#8 LDR R9, [R12,R9,LSL#2] EOR R10, R10, R9 AND R9, R0, R7,LSR#16 LDR R9, [R3,R9,LSL#2] MOV R7, R7,LSR#24 LDR R7, [R2,R7,LSL#2] EOR R9, R10, R9 EOR R7, R9, R7 STR R7, [R1,#0x20] ;запись 0x20 SUB R7, R5, R4 SUB R7, R7, #0x67 ADD R7, R7, #0x39C00 ADD R7, R7, #0x3740000 ADD R7, R7, #0xE0000000 AND R9, R7, #0xFF LDR R10, [LR,R9,LSL#2] AND R9, R0, R7,LSR#8 LDR R9, [R12,R9,LSL#2] EOR R9, R10, R9 AND R10, R0, R7,LSR#16 LDR R10, [R3,R10,LSL#2] MOV R7, R7,LSR#24 LDR R7, [R2,R7,LSL#2] EOR R9, R9, R10 EOR R7, R9, R7 STR R7, [R1,#0x24] ;запись 0x24 MOV R7, R8,LSR#8 ORR R7, R7, R5,LSL#24 MOV R5, R5,LSR#8 ORR R5, R5, R8,LSL#24 ADD R8, R7, R6 ADD R8, R8, #0xCD ADD R8, R8, #0xC800 SUB R8, R8, #0x6F00000 ADD R8, R8, #0x40000000 AND R9, R8, #0xFF LDR R10, [LR,R9,LSL#2] AND R9, R0, R8,LSR#8 LDR R9, [R12,R9,LSL#2] EOR R10, R10, R9 AND R9, R0, R8,LSR#16 LDR R9, [R3,R9,LSL#2] MOV R8, R8,LSR#24 LDR R8, [R2,R8,LSL#2] EOR R9, R10, R9 EOR R8, R9, R8 STR R8, [R1,#0x28] ;запись 0x28 SUB R8, R5, R4 SUB R8, R8, #0xCD SUB R8, R8, #0xC800 ADD R8, R8, #0x6F00000 ADD R8, R8, #0xC0000000 AND R9, R8, #0xFF AND R10, R0, R8,LSR#8 LDR R10, [R12,R10,LSL#2] LDR R9, [LR,R9,LSL#2] EOR R9, R9, R10 AND R10, R0, R8,LSR#16 LDR R10, [R3,R10,LSL#2] MOV R8, R8,LSR#24 LDR R8, [R2,R8,LSL#2] EOR R9, R9, R10 EOR R8, R9, R8 STR R8, [R1,#0x2C] ;запись 0x2c MOV R8, R6,LSL#8 ORR R8, R8, R4,LSR#24 MOV R4, R4,LSL#8 ORR R4, R4, R6,LSR#24 ADD R6, R7, R8 ADD R6, R6, #0x99 ADD R6, R6, #0x9100 ADD R6, R6, #0x210000 ADD R6, R6, #0x72000000 AND R9, R6, #0xFF AND R10, R0, R6,LSR#8 LDR R10, [R12,R10,LSL#2] LDR R9, [LR,R9,LSL#2] EOR R9, R9, R10 AND R10, R0, R6,LSR#16 LDR R10, [R3,R10,LSL#2] MOV R6, R6,LSR#24 LDR R6, [R2,R6,LSL#2] EOR R9, R9, R10 EOR R6, R9, R6 STR R6, [R1,#0x30] ;запись 0x30 SUB R6, R5, R4 ADD R6, R6, #0x67 ADD R6, R6, #0x6E00 ADD R6, R6, #0xDE0000 ADD R6, R6, #0x8D000000 AND R9, R6, #0xFF AND R10, R0, R6,LSR#8 LDR R10, [R12,R10,LSL#2] LDR R9, [LR,R9,LSL#2] EOR R10, R9, R10 AND R9, R0, R6,LSR#16 LDR R9, [R3,R9,LSL#2] MOV R6, R6,LSR#24 LDR R6, [R2,R6,LSL#2] EOR R9, R10, R9 EOR R6, R9, R6 STR R6, [R1,#0x34] ;запись 0x34 MOV R6, R7,LSR#8 ORR R6, R6, R5,LSL#24 MOV R5, R5,LSR#8 ORR R5, R5, R7,LSL#24 ADD R7, R6, R8 SUB R7, R7, #0xCF ADD R7, R7, #0x32400 SUB R7, R7, #0x1BC00000 AND R9, R7, #0xFF LDR R10, [LR,R9,LSL#2] AND R9, R0, R7,LSR#8 LDR R9, [R12,R9,LSL#2] EOR R10, R10, R9 AND R9, R0, R7,LSR#16 LDR R9, [R3,R9,LSL#2] MOV R7, R7,LSR#24 LDR R7, [R2,R7,LSL#2] EOR R9, R10, R9 EOR R7, R9, R7 STR R7, [R1,#0x38] ;запись 0x38 SUB R7, R5, R4 ADD R7, R7, #0xCF SUB R7, R7, #0x32400 ADD R7, R7, #0x1BC00000 AND R9, R7, #0xFF AND R10, R0, R7,LSR#8 LDR R10, [R12,R10,LSL#2] LDR R9, [LR,R9,LSL#2] EOR R9, R9, R10 AND R10, R0, R7,LSR#16 LDR R10, [R3,R10,LSL#2] MOV R7, R7,LSR#24 LDR R7, [R2,R7,LSL#2] EOR R9, R9, R10 EOR R7, R9, R7 STR R7, [R1,#0x3C] ;;запись 0x3c MOV R7, R8,LSL#8 ORR R7, R7, R4,LSR#24 MOV R4, R4,LSL#8 ORR R4, R4, R8,LSR#24 ADD R8, R6, R7 ADD R8, R8, #0x62 ADD R8, R8, #0x4600 ADD R8, R8, #0x860000 ADD R8, R8, #0xC8000000 AND R9, R8, #0xFF AND R10, R0, R8,LSR#8 LDR R10, [R12,R10,LSL#2] LDR R9, [LR,R9,LSL#2] EOR R10, R9, R10 AND R9, R0, R8,LSR#16 LDR R9, [R3,R9,LSL#2] MOV R8, R8,LSR#24 LDR R8, [R2,R8,LSL#2] EOR R9, R10, R9 EOR R8, R9, R8 STR R8, [R1,#0x40] ;запись 0x40 SUB R8, R5, R4 ADD R8, R8, #0x9E ADD R8, R8, #0xB900 SUB R8, R8, #0x870000 ADD R8, R8, #0x38000000 AND R9, R8, #0xFF LDR R10, [LR,R9,LSL#2] AND R9, R0, R8,LSR#8 LDR R9, [R12,R9,LSL#2] EOR R10, R10, R9 AND R9, R0, R8,LSR#16 LDR R9, [R3,R9,LSL#2] MOV R8, R8,LSR#24 LDR R8, [R2,R8,LSL#2] EOR R9, R10, R9 EOR R8, R9, R8 STR R8, [R1,#0x44] ;запись 0x44 MOV R8, R6,LSR#8 ORR R8, R8, R5,LSL#24 MOV R5, R5,LSR#8 ORR R5, R5, R6,LSL#24 ADD R6, R8, R7 SUB R6, R6, #0x33C ADD R6, R6, #0xC9000 ADD R6, R6, #0x91000000 AND R9, R6, #0xFF AND R10, R0, R6,LSR#8 LDR R10, [R12,R10,LSL#2] LDR R9, [LR,R9,LSL#2] EOR R10, R9, R10 AND R9, R0, R6,LSR#16 LDR R9, [R3,R9,LSL#2] MOV R6, R6,LSR#24 LDR R6, [R2,R6,LSL#2] EOR R9, R10, R9 EOR R6, R9, R6 STR R6, [R1,#0x48] ;запись 0x48 SUB R6, R5, R4 ADD R6, R6, #0x33C SUB R6, R6, #0xC9000 ADD R6, R6, #0x6F000000 AND R9, R6, #0xFF AND R10, R0, R6,LSR#8 LDR R10, [R12,R10,LSL#2] LDR R9, [LR,R9,LSL#2] EOR R10, R9, R10 AND R9, R0, R6,LSR#16 LDR R9, [R3,R9,LSL#2] MOV R6, R6,LSR#24 LDR R6, [R2,R6,LSL#2] EOR R9, R10, R9 EOR R6, R9, R6 STR R6, [R1,#0x4C] ;запись 0x4c MOV R6, R7,LSL#8 ORR R6, R6, R4,LSR#24 MOV R4, R4,LSL#8 ORR R4, R4, R7,LSR#24 ADD R7, R8, R6 ADD R7, R7, #0x188 ADD R7, R7, #0x11800 ADD R7, R7, #dword_2180000 ADD R7, R7, #0x20000000 AND R9, R7, #0xFF AND R10, R0, R7,LSR#8 LDR R10, [R12,R10,LSL#2] LDR R9, [LR,R9,LSL#2] EOR R9, R9, R10 AND R10, R0, R7,LSR#16 LDR R10, [R3,R10,LSL#2] MOV R7, R7,LSR#24 LDR R7, [R2,R7,LSL#2] EOR R9, R9, R10 EOR R7, R9, R7 STR R7, [R1,#0x50] ;запись 0x50 SUB R7, R5, R4 ADD R7, R7, #0x278 ADD R7, R7, #0x2E400 SUB R7, R7, #loc_21C0000 ADD R7, R7, #0xE0000000 AND R9, R7, #0xFF AND R10, R0, R7,LSR#8 LDR R10, [R12,R10,LSL#2] LDR R9, [LR,R9,LSL#2] EOR R9, R9, R10 AND R10, R0, R7,LSR#16 LDR R10, [R3,R10,LSL#2] MOV R7, R7,LSR#24 LDR R7, [R2,R7,LSL#2] EOR R9, R9, R10 EOR R7, R9, R7 STR R7, [R1,#0x54] ;;запись 0x54 MOV R7, R8,LSR#8 ORR R7, R7, R5,LSL#24 MOV R5, R5,LSR#8 ORR R5, R5, R8,LSL#24 ADD R8, R7, R6 SUB R8, R8, #0xF1 ADD R8, R8, #0x23400 ADD R8, R8, #0x4300000 ADD R8, R8, #0x40000000 AND R9, R8, #0xFF LDR R10, [LR,R9,LSL#2] AND R9, R0, R8,LSR#8 LDR R9, [R12,R9,LSL#2] EOR R10, R10, R9 AND R9, R0, R8,LSR#16 LDR R9, [R3,R9,LSL#2] MOV R8, R8,LSR#24 LDR R8, [R2,R8,LSL#2] EOR R9, R10, R9 EOR R8, R9, R8 STR R8, [R1,#0x58] ;запись 0x58 SUB R8, R5, R4 ADD R8, R8, #0xF1 SUB R8, R8, #0x23400 SUB R8, R8, #0x4300000 ADD R8, R8, #0xC0000000 AND R9, R8, #0xFF LDR R10, [LR,R9,LSL#2] AND R9, R0, R8,LSR#8 LDR R9, [R12,R9,LSL#2] EOR R9, R10, R9 AND R10, R0, R8,LSR#16 LDR R10, [R3,R10,LSL#2] MOV R8, R8,LSR#24 LDR R8, [R2,R8,LSL#2] EOR R9, R9, R10 EOR R8, R9, R8 STR R8, [R1,#0x5C] ;запись 0x5c MOV R8, R6,LSL#8 ORR R8, R8, R4,LSR#24 MOV R4, R4,LSL#8 ORR R4, R4, R6,LSR#24 ADD R6, R7, R8 ADD R6, R6, #0x8000001D ADD R6, R6, #0x6600 ADD R6, R6, #0x640000 ADD R6, R6, #0x8000000 AND R9, R6, #0xFF AND R10, R0, R6,LSR#8 LDR R10, [R12,R10,LSL#2] LDR R9, [LR,R9,LSL#2] EOR R10, R9, R10 AND R9, R0, R6,LSR#16 LDR R9, [R3,R9,LSL#2] MOV R6, R6,LSR#24 LDR R6, [R2,R6,LSL#2] EOR R9, R10, R9 EOR R6, R9, R6 STR R6, [R1,#0x60] ;запись 0x60 SUB R6, R5, R4 ADD R6, R6, #0xE3 SUB R6, R6, #0x6700 ADD R6, R6, #0x39C0000 ADD R6, R6, #0x74000000 AND R9, R6, #0xFF LDR R10, [LR,R9,LSL#2] AND R9, R0, R6,LSR#8 LDR R9, [R12,R9,LSL#2] EOR R10, R10, R9 AND R9, R0, R6,LSR#16 LDR R9, [R3,R9,LSL#2] MOV R6, R6,LSR#24 LDR R6, [R2,R6,LSL#2] EOR R9, R10, R9 EOR R6, R9, R6 STR R6, [R1,#0x64] ;запись 0x64 MOV R6, R7,LSR#8 ORR R6, R6, R5,LSL#24 MOV R5, R5,LSR#8 ORR R5, R5, R7,LSL#24 ADD R7, R6, R8 ADD R7, R7, #0x3A ADD R7, R7, #0xCC00 ADD R7, R7, #0xC80000 ADD R7, R7, #0x10000000 AND R9, R7, #0xFF AND R10, R0, R7,LSR#8 LDR R10, [R12,R10,LSL#2] LDR R9, [LR,R9,LSL#2] EOR R9, R9, R10 AND R10, R0, R7,LSR#16 LDR R10, [R3,R10,LSL#2] MOV R7, R7,LSR#24 LDR R7, [R2,R7,LSL#2] EOR R9, R9, R10 EOR R7, R9, R7 STR R7, [R1,#0x68] ;запись 0x68 SUB R7, R5, R4 SUB R7, R7, #0x3A ADD R7, R7, #0x33400 SUB R7, R7, #0xCC0000 ADD R7, R7, #0xF0000000 AND R9, R7, #0xFF AND R10, R0, R7,LSR#8 LDR R10, [R12,R10,LSL#2] LDR R9, [LR,R9,LSL#2] EOR R10, R9, R10 AND R9, R0, R7,LSR#16 LDR R9, [R3,R9,LSL#2] MOV R7, R7,LSR#24 LDR R7, [R2,R7,LSL#2] EOR R9, R10, R9 EOR R7, R9, R7 STR R7, [R1,#0x6C] ;запись 0x6c MOV R7, R8,LSL#8 ORR R7, R7, R4,LSR#24 MOV R4, R4,LSL#8 ORR R8, R4, R8,LSR#24 ADD R4, R6, R7 ADD R4, R4, #0x73 ADD R4, R4, #0x19800 ADD R4, R4, #0x1900000 ADD R4, R4, #0x20000000 AND R9, R4, #0xFF LDR R10, [LR,R9,LSL#2] AND R9, R0, R4,LSR#8 LDR R9, [R12,R9,LSL#2] EOR R10, R10, R9 AND R9, R0, R4,LSR#16 LDR R9, [R3,R9,LSL#2] MOV R4, R4,LSR#24 LDR R4, [R2,R4,LSL#2] EOR R9, R10, R9 EOR R4, R9, R4 STR R4, [R1,#0x70] ;;запись 0x70 SUB R4, R5, R8 SUB R4, R4, #0x73 SUB R4, R4, #0x19800 ADD R4, R4, #0xE700000 ADD R4, R4, #0xD0000000 AND R9, R4, #0xFF LDR R10, [LR,R9,LSL#2] AND R9, R0, R4,LSR#8 LDR R9, [R12,R9,LSL#2] EOR R10, R10, R9 AND R9, R0, R4,LSR#16 LDR R9, [R3,R9,LSL#2] MOV R4, R4,LSR#24 LDR R4, [R2,R4,LSL#2] EOR R9, R10, R9 EOR R4, R9, R4 STR R4, [R1,#0x74] ;запись 0x74 MOV R4, R6,LSR#8 ORR R4, R4, R5,LSL#24 ADD R4, R4, R7 ADD R4, R4, #0xE5 ADD R4, R4, #0x33000 ADD R4, R4, #0x3200000 MOV R5, R5,LSR#8 ORR R5, R5, R6,LSL#24 ADD R4, R4, #0x40000000 AND R6, R4, #0xFF LDR R7, [LR,R6,LSL#2] AND R6, R0, R4,LSR#8 LDR R6, [R12,R6,LSL#2] EOR R7, R7, R6 AND R6, R0, R4,LSR#16 LDR R6, [R3,R6,LSL#2] MOV R4, R4,LSR#24 LDR R4, [R2,R4,LSL#2] EOR R6, R7, R6 EOR R4, R6, R4 STR R4, [R1,#0x78] ;запись 0x78 SUB R4, R5, R8 SUB R4, R4, #0xE5 ADD R4, R4, #0xCD000 SUB R4, R4, #0x3300000 ADD R4, R4, #0xC0000000 AND R5, R4, #0xFF LDR LR, [LR,R5,LSL#2] AND R5, R0, R4,LSR#8 AND R0, R0, R4,LSR#16 LDR R0, [R3,R0,LSL#2] LDR R12, [R12,R5,LSL#2] MOV R3, R4,LSR#24 LDR R2, [R2,R3,LSL#2] EOR R12, LR, R12 EOR R0, R12, R0 EOR R0, R0, R2 STR R0, [R1,#0x7C] ;запись последнего значения, 0x7С LDMFD SP!, {R4-R10,PC} ; End of function sub_1DBC554
В своем коде тоже выполним предварительную подготовку, каркас функции sub_1DBE83C - инициализацию блока памяти. Забегая вперед - в начале функции видно, что используются таблички констант, идут подряд, размер 0x400. Сохраним их сразу в файлы и загрузим в свой код.
Сохраняем, выполнить поочереди команды в консоли или отдельным batch-файлом:
data.save.binary "tab1.bin" 0x0224C2F4--(0x0224C2F4+0x400-1) data.save.binary "tab2.bin" 0x0224C6F4--(0x0224C6F4+0x400-1) data.save.binary "tab3.bin" 0x0224CAF4--(0x0224CAF4+0x400-1) data.save.binary "tab4.bin" 0x0224CEF4--(0x0224CEF4+0x400-1)
Как проще всего затащить в python? Я открываю в редакторе HxD (очень удобная, простая утилита, часто пользуюсь):
Ctrl+A, Ctrl-C и в питон в bytes.fromhex("29 89 A1…
stack = bytearray(256) const_b04 = [0xD073015C, 0x3C754BC2, 0xC18CE94A, 0xB0D10F3E] const_b14 = [0x268D66A7, 0x35A81A81, 0x6FBAD9FA, 0x36162501] # обрезал тут таблички, каждая размером 0x400 tab1=bytes.fromhex("29 89 A1 A8 05 85 81 84 16 .... 92 98") tab2=bytes.fromhex("38 38 08 30 E8 28 C8 E0 2C .... 87 B3") tab3=bytes.fromhex("A1 A8 29 89 81 84 05 85 D2 .... 1A 8A") tab4=bytes.fromhex("08 30 38 38 C8 E0 E8 28 0D .... B4 37") for i, val in enumerate(const_b04): write_u32(0x64 + (i * 4), val) for i, val in enumerate(const_b14): write_u32(0x54 + (i * 4), val)
По листингу видно, что это какой-то развернутый цикл, но смущают разные константы, поэтому начал всё переписывать построчно… В эмуляторе тапаем по F2, в питоне сверяем. Начинает что-то получаться. Пропущу мучения с построчным переводом, сообразил что можно выделить функцию чтения из табличек, дело пошло бодрее:
def crypt1 (r2): r2 = r2 & 0xFFFFFFFF idx_tab1 = r2 & 0xFF idx_tab2 = (r2 >> 8) & 0xFF idx_tab3 = (r2 >> 16) & 0xFF idx_tab4 = (r2 >> 24) & 0xFF val_tab1 = read_u32(tab1, idx_tab1 << 2) val_tab2 = read_u32(tab2, idx_tab2 << 2) val_tab3 = read_u32(tab3, idx_tab3 << 2) val_tab4 = read_u32(tab4, idx_tab4 << 2) val = val_tab1 ^ val_tab2 ^ val_tab3 ^ val_tab4 return val b0 = stack[0x64 + 0] b1 = stack[0x64 + 1] b2 = stack[0x64 + 2] b3 = stack[0x64 + 3] val = crypt1 (b0 + b2 + 0x47 + 0x8600 + 0x1C80000 + 0x60000000) write_u32(0x74 +0 , val) val = crypt1 (b1 - b3 + 0xB9 - 0x8700 - 0x1C80000 + 0xA0000000) write_u32(0x74 +4 , val) val = crypt1 ((b1 << 24) + b2 + 0x8D + 0x10C00 + 0x3900000 + 0xC0000000) write_u32(0x74 +8 , val) val = crypt1 ((b0 <<24) - b3 - 0x8D - 0x10C00 -0x3900000 + 0x40000000) write_u32(0x74 +12 , val) val = crypt1 ((b2 <<8) + (b1 <<24) +0x8000001A + 0x1900 - 0xDE0000 +0x8000000) write_u32(0x74 +16 , val) ...
Метод рабочий, но подумав вышло, что так делать не надо. В этом снова помогает эмуляция. Функция за все время вызывается 2 раза, начинает с констант, использует одни таблички. Ставим бряк сразу после нее на 01DBE878, смотрим результат после первого запуска, после второго. Меняем серийник, перезапускаем. Результат одинаковый. Получили еще 1 урок: сначала надо думать, потом делать )
Сохраняем этот блок, data.save.binary …=> HxD => код:
stack = bytes.fromhex("00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C 00 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 DB E8 78 26 8D 66 A7 35 A8 1A 81 6F BA D9 FA 36 16 25 01 D0 73 01 5C 3C 75 4B C2 C1 8C E9 4A B0 D1 0F 3E 66 77 6C A4 F2 B2 13 98 54 B8 D9 E1 F6 6B DA B9 A3 AD BD 1D 9E 01 71 88 D7 E5 4E 81 17 55 68 9A 43 3E 6A C5 E8 F9 02 45 69 B3 F0 E1 DA C4 66 26 51 25 CB 71 67 00 14 9D BE 61 36 3F 1D 4E 08 C4 61 E8 31 C6 21 83 42 9D 4C 42 5E 6F CE DF 8A C0 01 D8 D7 61 DA DC E0 E8 FA F9 5C C0 94 3A CC E4 91 FA 00 C8 7A B8 39 1F 51 CF CC 6C 4C 7E 83 ED 65 43 97 31 9B 48 13 C1 2F A9 69 0A CA 04 F3 50 00 00 00 00 00 00 00 00 02 03 D6 54") # и всего делов
С новыми знаниями подступаем к последней функции, по сути, как оказалось, единственной в этом алгоритме. Тоже портянка. Таблички пригодилсь, тоже тут есть. Тоже развернутый цикл, но без записи по ходу, собирает, ксорит, в конце блоком пишет.
sub_1DBCEF0
ROM:01DBCEF0 sub_1DBCEF0 ; CODE XREF: ROM:01DBE6E0p ROM:01DBCEF0 ; ROM:01DBE720p ... ROM:01DBCEF0 STMFD SP!, {R4-R11,LR} ROM:01DBCEF4 LDMIB R0, {R3,R8} ROM:01DBCEF8 LDR R6, [R0,#0xC] ROM:01DBCEFC LDR R7, [R0] ROM:01DBCF00 LDR R0, [R2] ROM:01DBCF04 LDR R11, =tab1 ROM:01DBCF08 EOR R5, R8, R0 ROM:01DBCF0C LDR R0, [R2,#4] ROM:01DBCF10 LDR LR, =tab2 ROM:01DBCF14 EOR R0, R0, R6 ROM:01DBCF18 EOR R4, R0, R5 ROM:01DBCF1C AND R0, R4, #0xFF ROM:01DBCF20 LDR R12, [R11,R0,LSL#2] ; tab1 ROM:01DBCF24 MOV R0, #0xFF ROM:01DBCF28 AND R9, R0, R4,LSR#8 ROM:01DBCF2C LDR R9, [LR,R9,LSL#2] ; tab2 ROM:01DBCF30 AND R10, R0, R4,LSR#16 ROM:01DBCF34 EOR R9, R12, R9 ROM:01DBCF38 LDR R12, =tab3 ROM:01DBCF3C MOV R4, R4,LSR#24 ROM:01DBCF40 LDR R10, [R12,R10,LSL#2] ; tab3 ROM:01DBCF44 EOR R9, R9, R10 ROM:01DBCF48 LDR R10, =tab4 ROM:01DBCF4C LDR R4, [R10,R4,LSL#2] ; tab4 ROM:01DBCF50 EOR R4, R9, R4 ROM:01DBCF54 ADD R5, R5, R4 ; R5 тут - результат блока, он переиспользуется в следующем ROM:01DBCF58 AND R9, R5, #0xFF ; буду ставить бряк на AND-ах, сверяться ROM:01DBCF5C AND R10, R0, R5,LSR#8 ROM:01DBCF60 LDR R10, [LR,R10,LSL#2] ; tab2 ROM:01DBCF64 LDR R9, [R11,R9,LSL#2] ; tab1 ROM:01DBCF68 EOR R10, R9, R10 ROM:01DBCF6C AND R9, R0, R5,LSR#16 ROM:01DBCF70 LDR R9, [R12,R9,LSL#2] ; tab3 ROM:01DBCF74 MOV R5, R5,LSR#24 ROM:01DBCF78 EOR R9, R10, R9 ROM:01DBCF7C LDR R10, =tab4 ROM:01DBCF80 LDR R5, [R10,R5,LSL#2] ROM:01DBCF84 EOR R5, R9, R5 ROM:01DBCF88 ADD R4, R4, R5 ; Тут результат в R4 ROM:01DBCF8C AND R9, R4, #0xFF ; бряк ROM:01DBCF90 LDR R10, [R11,R9,LSL#2] ROM:01DBCF94 AND R9, R0, R4,LSR#8 ROM:01DBCF98 LDR R9, [LR,R9,LSL#2] ROM:01DBCF9C EOR R9, R10, R9 ROM:01DBCFA0 AND R10, R0, R4,LSR#16 ROM:01DBCFA4 LDR R10, [R12,R10,LSL#2] ROM:01DBCFA8 MOV R4, R4,LSR#24 ROM:01DBCFAC EOR R9, R9, R10 ROM:01DBCFB0 LDR R10, =tab4 ROM:01DBCFB4 LDR R4, [R10,R4,LSL#2] ROM:01DBCFB8 EOR R4, R9, R4 ROM:01DBCFBC ADD R5, R5, R4 ROM:01DBCFC0 EOR R3, R3, R4 ROM:01DBCFC4 LDR R4, [R2,#8] ROM:01DBCFC8 EOR R7, R7, R5 ROM:01DBCFCC EOR R5, R4, R7 ROM:01DBCFD0 LDR R4, [R2,#0xC] ROM:01DBCFD4 EOR R4, R4, R3 ROM:01DBCFD8 EOR R4, R4, R5 ROM:01DBCFDC AND R9, R4, #0xFF ; бряк ROM:01DBCFE0 LDR R10, [R11,R9,LSL#2] ROM:01DBCFE4 AND R9, R0, R4,LSR#8 ROM:01DBCFE8 LDR R9, [LR,R9,LSL#2] ROM:01DBCFEC EOR R9, R10, R9 ROM:01DBCFF0 AND R10, R0, R4,LSR#16 ROM:01DBCFF4 LDR R10, [R12,R10,LSL#2] ROM:01DBCFF8 MOV R4, R4,LSR#24 ROM:01DBCFFC EOR R9, R9, R10 ROM:01DBD000 LDR R10, =tab4 ROM:01DBD004 LDR R4, [R10,R4,LSL#2] ROM:01DBD008 EOR R4, R9, R4 ROM:01DBD00C ADD R5, R5, R4 ROM:01DBD010 AND R9, R5, #0xFF ROM:01DBD014 LDR R10, [R11,R9,LSL#2] ROM:01DBD018 AND R9, R0, R5,LSR#8 ROM:01DBD01C LDR R9, [LR,R9,LSL#2] ROM:01DBD020 EOR R9, R10, R9 ROM:01DBD024 AND R10, R0, R5,LSR#16 ROM:01DBD028 LDR R10, [R12,R10,LSL#2] ROM:01DBD02C MOV R5, R5,LSR#24 ROM:01DBD030 EOR R9, R9, R10 ROM:01DBD034 LDR R10, =tab4 ROM:01DBD038 LDR R5, [R10,R5,LSL#2] ROM:01DBD03C EOR R5, R9, R5 ROM:01DBD040 ADD R4, R4, R5 ROM:01DBD044 AND R9, R4, #0xFF ; бряк ROM:01DBD048 LDR R10, [R11,R9,LSL#2] ROM:01DBD04C AND R9, R0, R4,LSR#8 ROM:01DBD050 LDR R9, [LR,R9,LSL#2] ROM:01DBD054 EOR R10, R10, R9 ROM:01DBD058 AND R9, R0, R4,LSR#16 ROM:01DBD05C LDR R9, [R12,R9,LSL#2] ROM:01DBD060 MOV R4, R4,LSR#24 ROM:01DBD064 EOR R9, R10, R9 ROM:01DBD068 LDR R10, =tab4 ROM:01DBD06C LDR R4, [R10,R4,LSL#2] ROM:01DBD070 EOR R4, R9, R4 ROM:01DBD074 ADD R5, R5, R4 ROM:01DBD078 EOR R8, R8, R5 ROM:01DBD07C EOR R5, R6, R4 ROM:01DBD080 LDR R4, [R2,#0x10] ROM:01DBD084 EOR R6, R4, R8 ROM:01DBD088 LDR R4, [R2,#0x14] ROM:01DBD08C EOR R4, R4, R5 ROM:01DBD090 EOR R4, R4, R6 ROM:01DBD094 AND R9, R4, #0xFF ; бряк ROM:01DBD098 AND R10, R0, R4,LSR#8 ROM:01DBD09C LDR R10, [LR,R10,LSL#2] ROM:01DBD0A0 LDR R9, [R11,R9,LSL#2] ROM:01DBD0A4 EOR R10, R9, R10 ROM:01DBD0A8 AND R9, R0, R4,LSR#16 ROM:01DBD0AC LDR R9, [R12,R9,LSL#2] ROM:01DBD0B0 MOV R4, R4,LSR#24 ROM:01DBD0B4 EOR R9, R10, R9 ROM:01DBD0B8 LDR R10, =tab4 ROM:01DBD0BC LDR R4, [R10,R4,LSL#2] ROM:01DBD0C0 EOR R4, R9, R4 ROM:01DBD0C4 ADD R6, R6, R4 ROM:01DBD0C8 AND R9, R6, #0xFF ; бряк ROM:01DBD0CC LDR R10, [R11,R9,LSL#2] ROM:01DBD0D0 AND R9, R0, R6,LSR#8 ROM:01DBD0D4 LDR R9, [LR,R9,LSL#2] ROM:01DBD0D8 EOR R9, R10, R9 ROM:01DBD0DC AND R10, R0, R6,LSR#16 ROM:01DBD0E0 LDR R10, [R12,R10,LSL#2] ROM:01DBD0E4 MOV R6, R6,LSR#24 ROM:01DBD0E8 EOR R9, R9, R10 ROM:01DBD0EC LDR R10, =tab4 ROM:01DBD0F0 LDR R6, [R10,R6,LSL#2] ROM:01DBD0F4 EOR R6, R9, R6 ROM:01DBD0F8 ADD R4, R4, R6 ROM:01DBD0FC AND R9, R4, #0xFF ROM:01DBD100 LDR R10, [R11,R9,LSL#2] ROM:01DBD104 AND R9, R0, R4,LSR#8 ROM:01DBD108 LDR R9, [LR,R9,LSL#2] ROM:01DBD10C EOR R9, R10, R9 ROM:01DBD110 AND R10, R0, R4,LSR#16 ROM:01DBD114 LDR R10, [R12,R10,LSL#2] ROM:01DBD118 MOV R4, R4,LSR#24 ROM:01DBD11C EOR R9, R9, R10 ROM:01DBD120 LDR R10, =tab4 ROM:01DBD124 LDR R4, [R10,R4,LSL#2] ROM:01DBD128 EOR R4, R9, R4 ROM:01DBD12C ADD R6, R6, R4 ROM:01DBD130 EOR R4, R3, R4 ROM:01DBD134 LDR R3, [R2,#0x18] ROM:01DBD138 EOR R6, R7, R6 ROM:01DBD13C EOR R7, R3, R6 ROM:01DBD140 LDR R3, [R2,#0x1C] ROM:01DBD144 EOR R3, R3, R4 ROM:01DBD148 EOR R3, R3, R7 ROM:01DBD14C AND R9, R3, #0xFF ROM:01DBD150 LDR R10, [R11,R9,LSL#2] ROM:01DBD154 AND R9, R0, R3,LSR#8 ROM:01DBD158 LDR R9, [LR,R9,LSL#2] ROM:01DBD15C EOR R10, R10, R9 ROM:01DBD160 AND R9, R0, R3,LSR#16 ROM:01DBD164 LDR R9, [R12,R9,LSL#2] ROM:01DBD168 MOV R3, R3,LSR#24 ROM:01DBD16C EOR R9, R10, R9 ROM:01DBD170 LDR R10, =tab4 ROM:01DBD174 LDR R3, [R10,R3,LSL#2] ROM:01DBD178 EOR R3, R9, R3 ROM:01DBD17C ADD R7, R7, R3 ROM:01DBD180 AND R9, R7, #0xFF ROM:01DBD184 AND R10, R0, R7,LSR#8 ROM:01DBD188 LDR R10, [LR,R10,LSL#2] ROM:01DBD18C LDR R9, [R11,R9,LSL#2] ROM:01DBD190 EOR R10, R9, R10 ROM:01DBD194 AND R9, R0, R7,LSR#16 ROM:01DBD198 LDR R9, [R12,R9,LSL#2] ROM:01DBD19C MOV R7, R7,LSR#24 ROM:01DBD1A0 EOR R9, R10, R9 ROM:01DBD1A4 LDR R10, =tab4 ROM:01DBD1A8 LDR R7, [R10,R7,LSL#2] ROM:01DBD1AC EOR R7, R9, R7 ROM:01DBD1B0 ADD R3, R3, R7 ROM:01DBD1B4 AND R9, R3, #0xFF ROM:01DBD1B8 LDR R10, [R11,R9,LSL#2] ROM:01DBD1BC AND R9, R0, R3,LSR#8 ROM:01DBD1C0 LDR R9, [LR,R9,LSL#2] ROM:01DBD1C4 EOR R10, R10, R9 ROM:01DBD1C8 AND R9, R0, R3,LSR#16 ROM:01DBD1CC LDR R9, [R12,R9,LSL#2] ROM:01DBD1D0 MOV R3, R3,LSR#24 ROM:01DBD1D4 EOR R9, R10, R9 ROM:01DBD1D8 LDR R10, =tab4 ROM:01DBD1DC LDR R3, [R10,R3,LSL#2] ROM:01DBD1E0 EOR R3, R9, R3 ROM:01DBD1E4 ADD R7, R7, R3 ROM:01DBD1E8 EOR R9, R8, R7 ROM:01DBD1EC EOR R7, R5, R3 ROM:01DBD1F0 LDR R3, [R2,#0x20] ROM:01DBD1F4 EOR R5, R3, R9 ROM:01DBD1F8 LDR R3, [R2,#0x24] ROM:01DBD1FC EOR R3, R3, R7 ROM:01DBD200 EOR R3, R3, R5 ; +++ ROM:01DBD204 AND R8, R3, #0xFF ROM:01DBD208 LDR R8, [R11,R8,LSL#2] ROM:01DBD20C AND R10, R0, R3,LSR#8 ROM:01DBD210 LDR R10, [LR,R10,LSL#2] ROM:01DBD214 EOR R8, R8, R10 ROM:01DBD218 AND R10, R0, R3,LSR#16 ROM:01DBD21C LDR R10, [R12,R10,LSL#2] ROM:01DBD220 MOV R3, R3,LSR#24 ROM:01DBD224 EOR R8, R8, R10 ROM:01DBD228 LDR R10, =tab4 ROM:01DBD22C LDR R3, [R10,R3,LSL#2] ROM:01DBD230 EOR R3, R8, R3 ROM:01DBD234 ADD R5, R5, R3 ROM:01DBD238 AND R8, R5, #0xFF ROM:01DBD23C AND R10, R0, R5,LSR#8 ROM:01DBD240 LDR R10, [LR,R10,LSL#2] ROM:01DBD244 LDR R8, [R11,R8,LSL#2] ROM:01DBD248 EOR R8, R8, R10 ROM:01DBD24C AND R10, R0, R5,LSR#16 ROM:01DBD250 LDR R10, [R12,R10,LSL#2] ROM:01DBD254 MOV R5, R5,LSR#24 ROM:01DBD258 EOR R8, R8, R10 ROM:01DBD25C LDR R10, =tab4 ROM:01DBD260 LDR R5, [R10,R5,LSL#2] ROM:01DBD264 MOV R10, #0xFF ROM:01DBD268 EOR R5, R8, R5 ROM:01DBD26C ADD R8, R3, R5 ROM:01DBD270 AND R3, R8, #0xFF ROM:01DBD274 AND R10, R10, R8,LSR#8 ROM:01DBD278 LDR R10, [LR,R10,LSL#2] ROM:01DBD27C LDR R3, [R11,R3,LSL#2] ROM:01DBD280 LDR R11, =tab1 ROM:01DBD284 EOR R3, R3, R10 ROM:01DBD288 AND R10, R0, R8,LSR#16 ROM:01DBD28C LDR R10, [R12,R10,LSL#2] ROM:01DBD290 MOV R8, R8,LSR#24 ROM:01DBD294 EOR R10, R3, R10 ROM:01DBD298 LDR R3, =tab4 ROM:01DBD29C LDR R8, [R3,R8,LSL#2] ROM:01DBD2A0 EOR R10, R10, R8 ROM:01DBD2A4 ADD R5, R5, R10 ROM:01DBD2A8 EOR R8, R6, R5 ROM:01DBD2AC LDR R5, [R2,#0x28] ROM:01DBD2B0 EOR R4, R4, R10 ROM:01DBD2B4 EOR R6, R5, R8 ROM:01DBD2B8 LDR R5, [R2,#0x2C] ROM:01DBD2BC EOR R5, R5, R4 ROM:01DBD2C0 EOR R5, R5, R6 ROM:01DBD2C4 AND R10, R5, #0xFF ROM:01DBD2C8 LDR R11, [R11,R10,LSL#2] ROM:01DBD2CC AND R10, R0, R5,LSR#8 ROM:01DBD2D0 LDR R10, [LR,R10,LSL#2] ROM:01DBD2D4 EOR R10, R11, R10 ROM:01DBD2D8 AND R11, R0, R5,LSR#16 ROM:01DBD2DC LDR R11, [R12,R11,LSL#2] ROM:01DBD2E0 MOV R5, R5,LSR#24 ROM:01DBD2E4 LDR R5, [R3,R5,LSL#2] ROM:01DBD2E8 EOR R10, R10, R11 ROM:01DBD2EC EOR R5, R10, R5 ROM:01DBD2F0 ADD R6, R6, R5 ROM:01DBD2F4 LDR R11, =tab1 ROM:01DBD2F8 AND R10, R6, #0xFF ROM:01DBD2FC LDR R11, [R11,R10,LSL#2] ROM:01DBD300 AND R10, R0, R6,LSR#8 ROM:01DBD304 LDR R10, [LR,R10,LSL#2] ROM:01DBD308 EOR R11, R11, R10 ROM:01DBD30C AND R10, R0, R6,LSR#16 ROM:01DBD310 LDR R10, [R12,R10,LSL#2] ROM:01DBD314 MOV R6, R6,LSR#24 ROM:01DBD318 LDR R6, [R3,R6,LSL#2] ROM:01DBD31C EOR R10, R11, R10 ROM:01DBD320 EOR R6, R10, R6 ROM:01DBD324 ADD R5, R5, R6 ROM:01DBD328 LDR R11, =tab1 ROM:01DBD32C AND R10, R5, #0xFF ROM:01DBD330 LDR R10, [R11,R10,LSL#2] ROM:01DBD334 AND R11, R0, R5,LSR#8 ROM:01DBD338 LDR R11, [LR,R11,LSL#2] ROM:01DBD33C EOR R10, R10, R11 ROM:01DBD340 AND R11, R0, R5,LSR#16 ROM:01DBD344 LDR R11, [R12,R11,LSL#2] ROM:01DBD348 MOV R5, R5,LSR#24 ROM:01DBD34C LDR R5, [R3,R5,LSL#2] ROM:01DBD350 EOR R10, R10, R11 ROM:01DBD354 EOR R5, R10, R5 ROM:01DBD358 ADD R6, R6, R5 ROM:01DBD35C EOR R9, R9, R6 ROM:01DBD360 LDR R6, [R2,#0x30] ROM:01DBD364 EOR R5, R7, R5 ROM:01DBD368 EOR R7, R6, R9 ROM:01DBD36C LDR R6, [R2,#0x34] ROM:01DBD370 LDR R11, =tab1 ROM:01DBD374 EOR R6, R6, R5 ROM:01DBD378 EOR R6, R6, R7 ROM:01DBD37C AND R10, R6, #0xFF ROM:01DBD380 LDR R11, [R11,R10,LSL#2] ROM:01DBD384 AND R10, R0, R6,LSR#8 ROM:01DBD388 LDR R10, [LR,R10,LSL#2] ROM:01DBD38C EOR R11, R11, R10 ROM:01DBD390 AND R10, R0, R6,LSR#16 ROM:01DBD394 LDR R10, [R12,R10,LSL#2] ROM:01DBD398 MOV R6, R6,LSR#24 ROM:01DBD39C LDR R6, [R3,R6,LSL#2] ROM:01DBD3A0 EOR R10, R11, R10 ROM:01DBD3A4 EOR R6, R10, R6 ROM:01DBD3A8 ADD R7, R7, R6 ROM:01DBD3AC LDR R11, =tab1 ROM:01DBD3B0 AND R10, R7, #0xFF ROM:01DBD3B4 LDR R10, [R11,R10,LSL#2] ROM:01DBD3B8 AND R11, R0, R7,LSR#8 ROM:01DBD3BC LDR R11, [LR,R11,LSL#2] ROM:01DBD3C0 EOR R11, R10, R11 ROM:01DBD3C4 AND R10, R0, R7,LSR#16 ROM:01DBD3C8 LDR R10, [R12,R10,LSL#2] ROM:01DBD3CC MOV R7, R7,LSR#24 ROM:01DBD3D0 LDR R7, [R3,R7,LSL#2] ROM:01DBD3D4 EOR R10, R11, R10 ROM:01DBD3D8 EOR R7, R10, R7 ROM:01DBD3DC ADD R6, R6, R7 ROM:01DBD3E0 LDR R11, =tab1 ROM:01DBD3E4 AND R10, R6, #0xFF ROM:01DBD3E8 LDR R10, [R11,R10,LSL#2] ROM:01DBD3EC AND R11, R0, R6,LSR#8 ROM:01DBD3F0 LDR R11, [LR,R11,LSL#2] ROM:01DBD3F4 EOR R11, R10, R11 ROM:01DBD3F8 AND R10, R0, R6,LSR#16 ROM:01DBD3FC LDR R10, [R12,R10,LSL#2] ROM:01DBD400 MOV R6, R6,LSR#24 ROM:01DBD404 LDR R6, [R3,R6,LSL#2] ROM:01DBD408 EOR R10, R11, R10 ROM:01DBD40C EOR R6, R10, R6 ROM:01DBD410 ADD R7, R7, R6 ROM:01DBD414 EOR R6, R4, R6 ROM:01DBD418 LDR R4, [R2,#0x38] ROM:01DBD41C EOR R7, R8, R7 ROM:01DBD420 EOR R8, R4, R7 ROM:01DBD424 LDR R4, [R2,#0x3C] ROM:01DBD428 LDR R11, =tab1 ROM:01DBD42C EOR R4, R4, R6 ROM:01DBD430 EOR R4, R4, R8 ROM:01DBD434 AND R10, R4, #0xFF ROM:01DBD438 LDR R11, [R11,R10,LSL#2] ROM:01DBD43C AND R10, R0, R4,LSR#8 ROM:01DBD440 LDR R10, [LR,R10,LSL#2] ROM:01DBD444 EOR R11, R11, R10 ROM:01DBD448 AND R10, R0, R4,LSR#16 ROM:01DBD44C LDR R10, [R12,R10,LSL#2] ROM:01DBD450 MOV R4, R4,LSR#24 ROM:01DBD454 LDR R4, [R3,R4,LSL#2] ROM:01DBD458 EOR R10, R11, R10 ROM:01DBD45C EOR R4, R10, R4 ROM:01DBD460 ADD R8, R8, R4 ROM:01DBD464 LDR R11, =tab1 ROM:01DBD468 AND R10, R8, #0xFF ROM:01DBD46C LDR R11, [R11,R10,LSL#2] ROM:01DBD470 AND R10, R0, R8,LSR#8 ROM:01DBD474 LDR R10, [LR,R10,LSL#2] ROM:01DBD478 EOR R11, R11, R10 ROM:01DBD47C AND R10, R0, R8,LSR#16 ROM:01DBD480 LDR R10, [R12,R10,LSL#2] ROM:01DBD484 MOV R8, R8,LSR#24 ROM:01DBD488 LDR R8, [R3,R8,LSL#2] ROM:01DBD48C EOR R10, R11, R10 ROM:01DBD490 EOR R8, R10, R8 ROM:01DBD494 ADD R4, R4, R8 ROM:01DBD498 LDR R11, =tab1 ROM:01DBD49C AND R10, R4, #0xFF ROM:01DBD4A0 LDR R11, [R11,R10,LSL#2] ROM:01DBD4A4 AND R10, R0, R4,LSR#8 ROM:01DBD4A8 LDR R10, [LR,R10,LSL#2] ROM:01DBD4AC EOR R11, R11, R10 ROM:01DBD4B0 AND R10, R0, R4,LSR#16 ROM:01DBD4B4 LDR R10, [R12,R10,LSL#2] ROM:01DBD4B8 MOV R4, R4,LSR#24 ROM:01DBD4BC LDR R4, [R3,R4,LSL#2] ROM:01DBD4C0 EOR R10, R11, R10 ROM:01DBD4C4 EOR R4, R10, R4 ROM:01DBD4C8 ADD R8, R8, R4 ROM:01DBD4CC EOR R8, R9, R8 ROM:01DBD4D0 EOR R5, R5, R4 ROM:01DBD4D4 LDR R4, [R2,#0x40] ROM:01DBD4D8 LDR R9, [R2,#0x44] ROM:01DBD4DC EOR R4, R4, R8 ROM:01DBD4E0 EOR R9, R9, R5 ROM:01DBD4E4 EOR R9, R9, R4 ROM:01DBD4E8 LDR R11, =tab1 ROM:01DBD4EC AND R10, R9, #0xFF ROM:01DBD4F0 LDR R11, [R11,R10,LSL#2] ROM:01DBD4F4 AND R10, R0, R9,LSR#8 ROM:01DBD4F8 LDR R10, [LR,R10,LSL#2] ROM:01DBD4FC EOR R10, R11, R10 ROM:01DBD500 AND R11, R0, R9,LSR#16 ROM:01DBD504 LDR R11, [R12,R11,LSL#2] ROM:01DBD508 MOV R9, R9,LSR#24 ROM:01DBD50C LDR R9, [R3,R9,LSL#2] ROM:01DBD510 EOR R10, R10, R11 ROM:01DBD514 EOR R9, R10, R9 ROM:01DBD518 ADD R4, R4, R9 ROM:01DBD51C LDR R11, =tab1 ROM:01DBD520 AND R10, R4, #0xFF ROM:01DBD524 LDR R11, [R11,R10,LSL#2] ROM:01DBD528 AND R10, R0, R4,LSR#8 ROM:01DBD52C LDR R10, [LR,R10,LSL#2] ROM:01DBD530 EOR R11, R11, R10 ROM:01DBD534 AND R10, R0, R4,LSR#16 ROM:01DBD538 LDR R10, [R12,R10,LSL#2] ROM:01DBD53C MOV R4, R4,LSR#24 ROM:01DBD540 LDR R4, [R3,R4,LSL#2] ROM:01DBD544 EOR R10, R11, R10 ROM:01DBD548 EOR R4, R10, R4 ROM:01DBD54C ADD R9, R9, R4 ROM:01DBD550 LDR R11, =tab1 ROM:01DBD554 AND R10, R9, #0xFF ROM:01DBD558 LDR R11, [R11,R10,LSL#2] ROM:01DBD55C AND R10, R0, R9,LSR#8 ROM:01DBD560 LDR R10, [LR,R10,LSL#2] ROM:01DBD564 EOR R10, R11, R10 ROM:01DBD568 AND R11, R0, R9,LSR#16 ROM:01DBD56C LDR R11, [R12,R11,LSL#2] ROM:01DBD570 MOV R9, R9,LSR#24 ROM:01DBD574 LDR R9, [R3,R9,LSL#2] ROM:01DBD578 EOR R10, R10, R11 ROM:01DBD57C EOR R9, R10, R9 ROM:01DBD580 ADD R4, R4, R9 ROM:01DBD584 EOR R4, R7, R4 ROM:01DBD588 LDR R7, [R2,#0x48] ROM:01DBD58C EOR R6, R6, R9 ROM:01DBD590 EOR R9, R7, R4 ROM:01DBD594 LDR R7, [R2,#0x4C] ROM:01DBD598 LDR R11, =tab1 ROM:01DBD59C EOR R7, R7, R6 ROM:01DBD5A0 EOR R7, R7, R9 ROM:01DBD5A4 AND R10, R7, #0xFF ROM:01DBD5A8 LDR R11, [R11,R10,LSL#2] ROM:01DBD5AC AND R10, R0, R7,LSR#8 ROM:01DBD5B0 LDR R10, [LR,R10,LSL#2] ROM:01DBD5B4 EOR R11, R11, R10 ROM:01DBD5B8 AND R10, R0, R7,LSR#16 ROM:01DBD5BC LDR R10, [R12,R10,LSL#2] ROM:01DBD5C0 MOV R7, R7,LSR#24 ROM:01DBD5C4 LDR R7, [R3,R7,LSL#2] ROM:01DBD5C8 EOR R10, R11, R10 ROM:01DBD5CC EOR R7, R10, R7 ROM:01DBD5D0 ADD R9, R9, R7 ROM:01DBD5D4 LDR R11, =tab1 ROM:01DBD5D8 AND R10, R9, #0xFF ROM:01DBD5DC LDR R11, [R11,R10,LSL#2] ROM:01DBD5E0 AND R10, R0, R9,LSR#8 ROM:01DBD5E4 LDR R10, [LR,R10,LSL#2] ROM:01DBD5E8 EOR R10, R11, R10 ROM:01DBD5EC AND R11, R0, R9,LSR#16 ROM:01DBD5F0 LDR R11, [R12,R11,LSL#2] ROM:01DBD5F4 MOV R9, R9,LSR#24 ROM:01DBD5F8 LDR R9, [R3,R9,LSL#2] ROM:01DBD5FC EOR R10, R10, R11 ROM:01DBD600 EOR R9, R10, R9 ROM:01DBD604 ADD R7, R7, R9 ROM:01DBD608 LDR R11, =tab1 ROM:01DBD60C AND R10, R7, #0xFF ROM:01DBD610 LDR R10, [R11,R10,LSL#2] ROM:01DBD614 AND R11, R0, R7,LSR#8 ROM:01DBD618 LDR R11, [LR,R11,LSL#2] ROM:01DBD61C EOR R11, R10, R11 ROM:01DBD620 AND R10, R0, R7,LSR#16 ROM:01DBD624 LDR R10, [R12,R10,LSL#2] ROM:01DBD628 MOV R7, R7,LSR#24 ROM:01DBD62C LDR R7, [R3,R7,LSL#2] ROM:01DBD630 EOR R10, R11, R10 ROM:01DBD634 EOR R10, R10, R7 ROM:01DBD638 ADD R7, R9, R10 ROM:01DBD63C EOR R7, R8, R7 ROM:01DBD640 LDR R8, [R2,#0x50] ROM:01DBD644 LDR R9, [R2,#0x54] ROM:01DBD648 EOR R5, R5, R10 ROM:01DBD64C EOR R9, R9, R5 ROM:01DBD650 EOR R8, R8, R7 ROM:01DBD654 EOR R9, R9, R8 ROM:01DBD658 LDR R11, =tab1 ROM:01DBD65C AND R10, R9, #0xFF ROM:01DBD660 LDR R11, [R11,R10,LSL#2] ROM:01DBD664 AND R10, R0, R9,LSR#8 ROM:01DBD668 LDR R10, [LR,R10,LSL#2] ROM:01DBD66C EOR R10, R11, R10 ROM:01DBD670 AND R11, R0, R9,LSR#16 ROM:01DBD674 LDR R11, [R12,R11,LSL#2] ROM:01DBD678 MOV R9, R9,LSR#24 ROM:01DBD67C LDR R9, [R3,R9,LSL#2] ROM:01DBD680 EOR R10, R10, R11 ROM:01DBD684 EOR R9, R10, R9 ROM:01DBD688 ADD R8, R8, R9 ROM:01DBD68C LDR R11, =tab1 ROM:01DBD690 AND R10, R8, #0xFF ROM:01DBD694 LDR R10, [R11,R10,LSL#2] ROM:01DBD698 AND R11, R0, R8,LSR#8 ROM:01DBD69C LDR R11, [LR,R11,LSL#2] ROM:01DBD6A0 EOR R11, R10, R11 ROM:01DBD6A4 AND R10, R0, R8,LSR#16 ROM:01DBD6A8 LDR R10, [R12,R10,LSL#2] ROM:01DBD6AC MOV R8, R8,LSR#24 ROM:01DBD6B0 LDR R8, [R3,R8,LSL#2] ROM:01DBD6B4 EOR R10, R11, R10 ROM:01DBD6B8 EOR R8, R10, R8 ROM:01DBD6BC ADD R9, R9, R8 ROM:01DBD6C0 LDR R11, =tab1 ROM:01DBD6C4 AND R10, R9, #0xFF ROM:01DBD6C8 LDR R11, [R11,R10,LSL#2] ROM:01DBD6CC AND R10, R0, R9,LSR#8 ROM:01DBD6D0 LDR R10, [LR,R10,LSL#2] ROM:01DBD6D4 EOR R10, R11, R10 ROM:01DBD6D8 AND R11, R0, R9,LSR#16 ROM:01DBD6DC LDR R11, [R12,R11,LSL#2] ROM:01DBD6E0 MOV R9, R9,LSR#24 ROM:01DBD6E4 LDR R9, [R3,R9,LSL#2] ROM:01DBD6E8 EOR R10, R10, R11 ROM:01DBD6EC EOR R9, R10, R9 ROM:01DBD6F0 ADD R8, R8, R9 ROM:01DBD6F4 EOR R4, R4, R8 ROM:01DBD6F8 EOR R9, R6, R9 ROM:01DBD6FC LDR R6, [R2,#0x58] ROM:01DBD700 LDR R8, [R2,#0x5C] ROM:01DBD704 EOR R6, R6, R4 ROM:01DBD708 EOR R8, R8, R9 ROM:01DBD70C EOR R8, R8, R6 ROM:01DBD710 LDR R11, =tab1 ROM:01DBD714 AND R10, R8, #0xFF ROM:01DBD718 LDR R11, [R11,R10,LSL#2] ROM:01DBD71C AND R10, R0, R8,LSR#8 ROM:01DBD720 LDR R10, [LR,R10,LSL#2] ROM:01DBD724 EOR R10, R11, R10 ROM:01DBD728 AND R11, R0, R8,LSR#16 ROM:01DBD72C LDR R11, [R12,R11,LSL#2] ROM:01DBD730 MOV R8, R8,LSR#24 ROM:01DBD734 LDR R8, [R3,R8,LSL#2] ROM:01DBD738 EOR R10, R10, R11 ROM:01DBD73C EOR R8, R10, R8 ROM:01DBD740 ADD R6, R6, R8 ROM:01DBD744 LDR R11, =tab1 ROM:01DBD748 AND R10, R6, #0xFF ROM:01DBD74C LDR R11, [R11,R10,LSL#2] ROM:01DBD750 AND R10, R0, R6,LSR#8 ROM:01DBD754 LDR R10, [LR,R10,LSL#2] ROM:01DBD758 EOR R11, R11, R10 ROM:01DBD75C AND R10, R0, R6,LSR#16 ROM:01DBD760 LDR R10, [R12,R10,LSL#2] ROM:01DBD764 MOV R6, R6,LSR#24 ROM:01DBD768 LDR R6, [R3,R6,LSL#2] ROM:01DBD76C EOR R10, R11, R10 ROM:01DBD770 EOR R6, R10, R6 ROM:01DBD774 ADD R8, R8, R6 ROM:01DBD778 LDR R11, =tab1 ROM:01DBD77C AND R10, R8, #0xFF ROM:01DBD780 LDR R10, [R11,R10,LSL#2] ROM:01DBD784 AND R11, R0, R8,LSR#8 ROM:01DBD788 LDR R11, [LR,R11,LSL#2] ROM:01DBD78C EOR R10, R10, R11 ROM:01DBD790 AND R11, R0, R8,LSR#16 ROM:01DBD794 LDR R11, [R12,R11,LSL#2] ROM:01DBD798 MOV R8, R8,LSR#24 ROM:01DBD79C LDR R8, [R3,R8,LSL#2] ROM:01DBD7A0 EOR R10, R10, R11 ROM:01DBD7A4 EOR R8, R10, R8 ROM:01DBD7A8 ADD R6, R6, R8 ROM:01DBD7AC EOR R6, R7, R6 ROM:01DBD7B0 EOR R5, R5, R8 ROM:01DBD7B4 LDR R8, [R2,#0x64] ROM:01DBD7B8 LDR R7, [R2,#0x60] ROM:01DBD7BC EOR R8, R8, R5 ROM:01DBD7C0 EOR R7, R7, R6 ROM:01DBD7C4 EOR R8, R8, R7 ROM:01DBD7C8 LDR R11, =tab1 ROM:01DBD7CC AND R10, R8, #0xFF ROM:01DBD7D0 LDR R11, [R11,R10,LSL#2] ROM:01DBD7D4 AND R10, R0, R8,LSR#8 ROM:01DBD7D8 LDR R10, [LR,R10,LSL#2] ROM:01DBD7DC EOR R11, R11, R10 ROM:01DBD7E0 AND R10, R0, R8,LSR#16 ROM:01DBD7E4 LDR R10, [R12,R10,LSL#2] ROM:01DBD7E8 MOV R8, R8,LSR#24 ROM:01DBD7EC LDR R8, [R3,R8,LSL#2] ROM:01DBD7F0 EOR R10, R11, R10 ROM:01DBD7F4 EOR R8, R10, R8 ROM:01DBD7F8 ADD R7, R7, R8 ROM:01DBD7FC LDR R11, =tab1 ROM:01DBD800 AND R10, R7, #0xFF ROM:01DBD804 LDR R10, [R11,R10,LSL#2] ROM:01DBD808 AND R11, R0, R7,LSR#8 ROM:01DBD80C LDR R11, [LR,R11,LSL#2] ROM:01DBD810 EOR R11, R10, R11 ROM:01DBD814 AND R10, R0, R7,LSR#16 ROM:01DBD818 LDR R10, [R12,R10,LSL#2] ROM:01DBD81C MOV R7, R7,LSR#24 ROM:01DBD820 LDR R7, [R3,R7,LSL#2] ROM:01DBD824 EOR R10, R11, R10 ROM:01DBD828 EOR R7, R10, R7 ROM:01DBD82C ADD R8, R8, R7 ROM:01DBD830 LDR R11, =tab1 ROM:01DBD834 AND R10, R8, #0xFF ROM:01DBD838 LDR R11, [R11,R10,LSL#2] ROM:01DBD83C AND R10, R0, R8,LSR#8 ROM:01DBD840 LDR R10, [LR,R10,LSL#2] ROM:01DBD844 EOR R11, R11, R10 ROM:01DBD848 AND R10, R0, R8,LSR#16 ROM:01DBD84C LDR R10, [R12,R10,LSL#2] ROM:01DBD850 EOR R10, R11, R10 ROM:01DBD854 MOV R8, R8,LSR#24 ROM:01DBD858 LDR R8, [R3,R8,LSL#2] ROM:01DBD85C LDR R11, =tab1 ROM:01DBD860 EOR R8, R10, R8 ROM:01DBD864 ADD R7, R7, R8 ROM:01DBD868 EOR R4, R4, R7 ROM:01DBD86C LDR R7, [R2,#0x68] ROM:01DBD870 EOR R9, R9, R8 ROM:01DBD874 EOR R8, R7, R4 ROM:01DBD878 LDR R7, [R2,#0x6C] ROM:01DBD87C EOR R7, R7, R9 ROM:01DBD880 EOR R7, R7, R8 ROM:01DBD884 AND R10, R7, #0xFF ROM:01DBD888 LDR R10, [R11,R10,LSL#2] ROM:01DBD88C AND R11, R0, R7,LSR#8 ROM:01DBD890 LDR R11, [LR,R11,LSL#2] ROM:01DBD894 EOR R11, R10, R11 ROM:01DBD898 AND R10, R0, R7,LSR#16 ROM:01DBD89C LDR R10, [R12,R10,LSL#2] ROM:01DBD8A0 MOV R7, R7,LSR#24 ROM:01DBD8A4 LDR R7, [R3,R7,LSL#2] ROM:01DBD8A8 EOR R10, R11, R10 ROM:01DBD8AC EOR R7, R10, R7 ROM:01DBD8B0 ADD R8, R8, R7 ROM:01DBD8B4 LDR R11, =tab1 ROM:01DBD8B8 AND R10, R8, #0xFF ROM:01DBD8BC LDR R11, [R11,R10,LSL#2] ROM:01DBD8C0 AND R10, R0, R8,LSR#8 ROM:01DBD8C4 LDR R10, [LR,R10,LSL#2] ROM:01DBD8C8 EOR R11, R11, R10 ROM:01DBD8CC AND R10, R0, R8,LSR#16 ROM:01DBD8D0 LDR R10, [R12,R10,LSL#2] ROM:01DBD8D4 MOV R8, R8,LSR#24 ROM:01DBD8D8 LDR R8, [R3,R8,LSL#2] ROM:01DBD8DC EOR R10, R11, R10 ROM:01DBD8E0 EOR R8, R10, R8 ROM:01DBD8E4 ADD R7, R7, R8 ROM:01DBD8E8 LDR R11, =tab1 ROM:01DBD8EC AND R10, R7, #0xFF ROM:01DBD8F0 LDR R10, [R11,R10,LSL#2] ROM:01DBD8F4 AND R11, R0, R7,LSR#8 ROM:01DBD8F8 LDR R11, [LR,R11,LSL#2] ROM:01DBD8FC EOR R11, R10, R11 ROM:01DBD900 AND R10, R0, R7,LSR#16 ROM:01DBD904 LDR R10, [R12,R10,LSL#2] ROM:01DBD908 MOV R7, R7,LSR#24 ROM:01DBD90C LDR R7, [R3,R7,LSL#2] ROM:01DBD910 EOR R10, R11, R10 ROM:01DBD914 EOR R10, R10, R7 ROM:01DBD918 ADD R7, R8, R10 ROM:01DBD91C EOR R7, R6, R7 ROM:01DBD920 EOR R6, R5, R10 ROM:01DBD924 LDR R5, [R2,#0x70] ROM:01DBD928 LDR R11, =tab1 ROM:01DBD92C EOR R8, R5, R7 ROM:01DBD930 LDR R5, [R2,#0x74] ROM:01DBD934 EOR R5, R5, R6 ROM:01DBD938 EOR R5, R5, R8 ROM:01DBD93C AND R10, R5, #0xFF ROM:01DBD940 LDR R11, [R11,R10,LSL#2] ROM:01DBD944 AND R10, R0, R5,LSR#8 ROM:01DBD948 LDR R10, [LR,R10,LSL#2] ROM:01DBD94C EOR R11, R11, R10 ROM:01DBD950 AND R10, R0, R5,LSR#16 ROM:01DBD954 LDR R10, [R12,R10,LSL#2] ROM:01DBD958 MOV R5, R5,LSR#24 ROM:01DBD95C LDR R5, [R3,R5,LSL#2] ROM:01DBD960 EOR R10, R11, R10 ROM:01DBD964 EOR R5, R10, R5 ROM:01DBD968 ADD R8, R8, R5 ROM:01DBD96C LDR R11, =tab1 ROM:01DBD970 AND R10, R8, #0xFF ROM:01DBD974 LDR R11, [R11,R10,LSL#2] ROM:01DBD978 AND R10, R0, R8,LSR#8 ROM:01DBD97C LDR R10, [LR,R10,LSL#2] ROM:01DBD980 EOR R10, R11, R10 ROM:01DBD984 AND R11, R0, R8,LSR#16 ROM:01DBD988 LDR R11, [R12,R11,LSL#2] ROM:01DBD98C MOV R8, R8,LSR#24 ROM:01DBD990 LDR R8, [R3,R8,LSL#2] ROM:01DBD994 EOR R10, R10, R11 ROM:01DBD998 EOR R8, R10, R8 ROM:01DBD99C ADD R5, R5, R8 ROM:01DBD9A0 LDR R10, =tab1 ROM:01DBD9A4 MOV R0, #0xFF ROM:01DBD9A8 AND R0, R0, R5,LSR#8 ROM:01DBD9AC AND R11, R5, #0xFF ROM:01DBD9B0 LDR R11, [R10,R11,LSL#2] ROM:01DBD9B4 LDR R0, [LR,R0,LSL#2] ROM:01DBD9B8 EOR R11, R11, R0 ROM:01DBD9BC MOV R0, #0xFF ROM:01DBD9C0 AND R0, R0, R5,LSR#16 ROM:01DBD9C4 LDR R0, [R12,R0,LSL#2] ROM:01DBD9C8 MOV R5, R5,LSR#24 ROM:01DBD9CC LDR R5, [R3,R5,LSL#2] ROM:01DBD9D0 EOR R0, R11, R0 ROM:01DBD9D4 EOR R0, R0, R5 ROM:01DBD9D8 ADD R5, R8, R0 ROM:01DBD9DC EOR R4, R4, R5 ROM:01DBD9E0 LDR R5, [R2,#0x78] ROM:01DBD9E4 LDR R2, [R2,#0x7C] ROM:01DBD9E8 EOR R0, R9, R0 ROM:01DBD9EC EOR R2, R2, R0 ROM:01DBD9F0 EOR R8, R5, R4 ROM:01DBD9F4 EOR R2, R2, R8 ROM:01DBD9F8 AND R5, R2, #0xFF ROM:01DBD9FC LDR R9, [R10,R5,LSL#2] ROM:01DBDA00 MOV R5, #0xFF ROM:01DBDA04 AND R5, R5, R2,LSR#8 ROM:01DBDA08 LDR R5, [LR,R5,LSL#2] ROM:01DBDA0C EOR R9, R9, R5 ROM:01DBDA10 MOV R5, #0xFF ROM:01DBDA14 AND R5, R5, R2,LSR#16 ROM:01DBDA18 LDR R5, [R12,R5,LSL#2] ROM:01DBDA1C MOV R2, R2,LSR#24 ROM:01DBDA20 LDR R2, [R3,R2,LSL#2] ROM:01DBDA24 EOR R5, R9, R5 ROM:01DBDA28 EOR R5, R5, R2 ROM:01DBDA2C ADD R2, R8, R5 ROM:01DBDA30 AND R8, R2, #0xFF ROM:01DBDA34 LDR R9, [R10,R8,LSL#2] ROM:01DBDA38 MOV R8, #0xFF ROM:01DBDA3C AND R8, R8, R2,LSR#8 ROM:01DBDA40 LDR R8, [LR,R8,LSL#2] ROM:01DBDA44 EOR R9, R9, R8 ROM:01DBDA48 MOV R8, #0xFF ROM:01DBDA4C AND R8, R8, R2,LSR#16 ROM:01DBDA50 LDR R8, [R12,R8,LSL#2] ROM:01DBDA54 MOV R2, R2,LSR#24 ROM:01DBDA58 LDR R2, [R3,R2,LSL#2] ROM:01DBDA5C EOR R8, R9, R8 ROM:01DBDA60 EOR R2, R8, R2 ROM:01DBDA64 ADD R5, R5, R2 ROM:01DBDA68 AND R8, R5, #0xFF ROM:01DBDA6C LDR R9, [R10,R8,LSL#2] ROM:01DBDA70 MOV R8, #0xFF ROM:01DBDA74 AND R8, R8, R5,LSR#8 ROM:01DBDA78 LDR LR, [LR,R8,LSL#2] ROM:01DBDA7C MOV R8, #0xFF ROM:01DBDA80 AND R8, R8, R5,LSR#16 ROM:01DBDA84 LDR R12, [R12,R8,LSL#2] ROM:01DBDA88 EOR LR, R9, LR ROM:01DBDA8C EOR R12, LR, R12 ROM:01DBDA90 MOV LR, R5,LSR#24 ROM:01DBDA94 LDR R3, [R3,LR,LSL#2] ROM:01DBDA98 STR R0, [R1,#0xC] ROM:01DBDA9C EOR R3, R12, R3 ROM:01DBDAA0 ADD R2, R2, R3 ROM:01DBDAA4 EOR R2, R7, R2 ROM:01DBDAA8 EOR R3, R6, R3 ROM:01DBDAAC STMIA R1, {R2-R4} ;результат ROM:01DBDAB0 MOV R0, #0 ROM:01DBDAB4 LDMFD SP!, {R4-R11,PC} ROM:01DBDAB4 ; End of function sub_1DBCEF0
На опыте, поэтому сразу выделил чтение из табличек в функцию и сделал несколько итераций:
reg_tab=mem[r0:r0+0x10] out_tab=mem[r1:r1+0x10] key_tab=stack[0x74:0xff] def F_func(v, rkey, t_a, t_b, t_c, t_d): b0 = v & 0xFF b1 = (v >> 8) & 0xFF b2 = (v >> 16) & 0xFF b3 = (v >> 24) & 0xFF return (read_u32(t_a, b0 * 4) ^ read_u32(t_b, b1 * 4) ^ read_u32(t_c, b2 * 4) ^ read_u32(t_d, b3 * 4)) r7 = read_u32(reg_tab, 0) r3 = read_u32(reg_tab, 4) r8 = read_u32(reg_tab, 8) r6 = read_u32(reg_tab, 12) k0 = read_u32(key_tab, 0) k1 = read_u32(key_tab, 4) r5 = r8 ^ k0 r4 = (r6 ^ k1) ^ r5 f0_out = F_func(r4, 0, tab1, tab2, tab3, tab4) r4 = (f0_out) & 0xFFFFFFFF r5 = (r5 + r4) & 0xFFFFFFFF #ROM:01DBCF54 + f1_out = F_func(r5, 0, tab1, tab2, tab3, tab4) r5 = ( f1_out) & 0xFFFFFFFF r4 = (r4 + r5) & 0xFFFFFFFF # + f2_out = F_func(r4, 0, tab1, tab2, tab3, tab4) r4 = (f2_out ) & 0xFFFFFFFF r5 = (r5 + r4) & 0xFFFFFFFF # + ROM:01DBCFBC ADD R5, R5, R4 # ------------------------------------------ r3 = r3 ^ r4 k2 = read_u32(key_tab, 8) r7 = r7 ^ r5 r5 = k2 ^ r7 k3 = read_u32(key_tab, 12) r4 = (k3 ^ r3) ^ r5 # + ROM:01DBCFD8 EOR R4, R4, R5 # 46A1C2BD f3_out = F_func(r4, 0, tab1, tab2, tab3, tab4) r4 = f3_out r5 = (r4 + r5) & 0xFFFFFFFF # + B62CF143 f4_out = F_func(r5, 0, tab1, tab2, tab3, tab4) r5 = (f4_out) & 0xFFFFFFFF # + 1201847A r4 = (r4 + r5) & 0xFFFFFFFF # + FD2ED284 f5_out = F_func(r4, 0, tab1, tab2, tab3, tab4) r4 = (f5_out ) & 0xFFFFFFFF # + 06B18708 r5 = (r5 + r4) & 0xFFFFFFFF r8 = r8 ^ r5 r5 = r6 ^ r4 k4 = read_u32(key_tab, 0x10) r6 = k4 ^ r8 k5 = read_u32(key_tab, 0x14) r4 = (k5 ^ r5) ^ r6 # + 22BFEFDD f6_out = F_func(r4, 0, tab1, tab2, tab3, tab4) r6 = (r6 + f6_out) & 0xFFFFFFFF # + 4038DDE2 f7_out = F_func(r6, 0, tab1, tab2, tab3, tab4) r6 = ( f7_out) & 0xFFFFFFFF # + 8BF5176C r4 = (f6_out + r6) & 0xFFFFFFFF # +E3D1FF7F f8_out = F_func(r4, 0, tab1, tab2, tab3, tab4) r4 = (f8_out ) & 0xFFFFFFFF # + 4E9DC527 r6 = (r6 + r4) & 0xFFFFFFFF # + DA92DC93 r4 = r3 ^ r4 k6 = read_u32(key_tab, 0x18) r6 = r7 ^ r6 r7 = k6 ^ r6 k7 = read_u32(key_tab, 0x1C) r3 = (k7 ^ r4) ^ r7 f9_out = F_func(r3, 0, tab1, tab2, tab3, tab4) r7 = (r7 + f9_out) & 0xFFFFFFFF # + 4D37AF04 f10_out = F_func(r7, 0, tab1, tab2, tab3, tab4) r7 = ( f10_out) & 0xFFFFFFFF # + C1B56CB0 r3 = (f9_out + r7) & 0xFFFFFFFF # + 7BBC32EA f11_out = F_func(r3, 0, tab1, tab2, tab3, tab4) r3 = (f11_out ) & 0xFFFFFFFF # + 843B6A03 r7 = (f10_out + r3) & 0xFFFFFFFF # + 45F0D6B3 r9 = r8 ^ r7 r7 = r5 ^ r3 k8 = read_u32(key_tab, 0x20) r5 = k8 ^ r9 k9 = read_u32(key_tab, 0x24) r3 = (k9 ^ r7) ^ r5 # + 751FF778 r3 = F_func(r3, 0, tab1, tab2, tab3, tab4) r5 = (r5 + r3) & 0xFFFFFFFF r5 = F_func(r5, 0, tab1, tab2, tab3, tab4) r8 = (r5 + r3) & 0xFFFFFFFF f14_out = F_func(r8, 0, tab1, tab2, tab3, tab4) r10 = f14_out r5 = (r5 + r10) & 0xFFFFFFFF # adr:01DBD2A8 r8 = r6 ^ r5 r5 = read_u32(key_tab, 0x28) r4 = r4 ^ r10 r6 = r5 ^ r8 r5 = read_u32(key_tab, 0x2c) r5 = r5 ^ r4 ^ r6 r5 = F_func(r5, 0, tab1, tab2, tab3, tab4) r6 = (r6 + r5) & 0xFFFFFFFF r6 = F_func(r6, 0, tab1, tab2, tab3, tab4) r5 = (r5 + r6) & 0xFFFFFFFF r5 = F_func(r5, 0, tab1, tab2, tab3, tab4) r6 = (r6 + r5) & 0xFFFFFFFF r9 = r9 ^ r6 r6 = read_u32(key_tab, 0x30) r5 = r7 ^ r5 r7 = r6 ^ r9 r6 = read_u32(key_tab, 0x34) r6 = r6 ^ r5 ^ r7 # E46962FF r6 = F_func(r6, 0, tab1, tab2, tab3, tab4) r7 = (r7 + r6) & 0xFFFFFFFF r7 = F_func(r7, 0, tab1, tab2, tab3, tab4) r6 = (r6 + r7) & 0xFFFFFFFF r6 = F_func(r6, 0, tab1, tab2, tab3, tab4) r7 = (r7 + r6) & 0xFFFFFFFF # EC25CC1A r6 = r6 ^ r4 r4 = read_u32(key_tab, 0x38) r7 = r8 ^ r7 r8 = r4 ^ r7 r4 = read_u32(key_tab, 0x3c) r4 = r4 ^ r6 ^ r8 # # F211E4C4 # ------------------------- r4 = F_func(r4, 0, tab1, tab2, tab3, tab4) r8 = (r8 + r4) & 0xFFFFFFFF r8 = F_func(r8, 0, tab1, tab2, tab3, tab4) r4 = (r4 + r8) & 0xFFFFFFFF r4 = F_func(r4, 0, tab1, tab2, tab3, tab4) r8 = (r8 + r4) & 0xFFFFFFFF # 3C41F4F1 r8 = r9 ^ r8 r5 = r5 ^ r4 r4 = read_u32(key_tab, 0x40) r9 = read_u32(key_tab, 0x44) r4 = r4 ^ r8 r9 = r9 ^ r5 r9 = r9 ^ r4 #-------------------------- r9 = F_func(r9, 0, tab1, tab2, tab3, tab4) r4 = (r4 + r9) & 0xFFFFFFFF r4 = F_func(r4, 0, tab1, tab2, tab3, tab4) r9 = (r9 + r4) & 0xFFFFFFFF r9 = F_func(r9, 0, tab1, tab2, tab3, tab4) r4 = (r4 + r9) & 0xFFFFFFFF # r4 = r7 ^ r4 r7 = read_u32(key_tab, 0x48) r6 = r6 ^ r9 r9 = r7 ^ r4 r7 = read_u32(key_tab, 0x4c) r7 = r7 ^ r6 ^ r9 ..... # и тд
У меня не получилось свернуть это в цикл сразу, и как то уже руку набил, дошел до конца.
Сначала сообразил, что все манипуляции с табличками это работа с 2-мя числами, результат тоже 2 числа. Принцип такой - нужно избавится от регистров, проследить какие данные исходные, какие данные переиспользуются в следующем блоке. Выделил в функцию, код стал короче:
def round3(a, b): f1 = F_func(b, 0, tab1, tab2, tab3, tab4) b = (a + f1) & 0xFFFFFFFF f2 = F_func(b, 0, tab1, tab2, tab3, tab4) a = (f1 + f2) & 0xFFFFFFFF f3 = F_func(a, 0, tab1, tab2, tab3, tab4) b = (f2 + f3) & 0xFFFFFFFF return f3, b r7 = read_u32(reg_tab, 0) r3 = read_u32(reg_tab, 4) r8 = read_u32(reg_tab, 8) r6 = read_u32(reg_tab, 12) k0 = read_u32(key_tab, 0) k1 = read_u32(key_tab, 4) r5 = r8 ^ k0 #r8 r4 = r6 ^ k1 ^ r5 #r6 r4, r5 = round3(r5, r4) r3 = r3 ^ r4 #r3 r7 = r7 ^ r5 #r7 k2 = read_u32(key_tab, 8) r5 = k2 ^ r7 k3 = read_u32(key_tab, 12) r4 = k3 ^ r3 ^ r5 r4, r5 = round3(r5, r4) r8 = r8 ^ r5 r5 = r6 ^ r4 k4 = read_u32(key_tab, 0x10) r6 = k4 ^ r8 k5 = read_u32(key_tab, 0x14) r4 = (k5 ^ r5) ^ r6 # + 22BFEFDD r4, r6 = round3(r6, r4) r4 = r3 ^ r4 k6 = read_u32(key_tab, 0x18) r6 = r7 ^ r6 r7 = k6 ^ r6 k7 = read_u32(key_tab, 0x1C) r3 = (k7 ^ r4) ^ r7 r3, r7 = round3(r7, r3) r9 = r8 ^ r7 r7 = r5 ^ r3 k8 = read_u32(key_tab, 0x20) r5 = k8 ^ r9 k9 = read_u32(key_tab, 0x24) r3 = (k9 ^ r7) ^ r5 # + 751FF778 r10, r5 = round3(r5, r3) ... и т. д.
Сворачиваем еще раз. Принцип тот же - избавится от регистров, первая итерация как есть, потом определяем какие данные и как используются на следующей:
for adr in range(0, 0x7c, 8): k0 = read_u32(key_tab, adr) k1 = read_u32(key_tab, adr + 4) r5 = k0 ^ x3 r4 = k1 ^ x4 ^ r5 r4, r5 = round3(r5, r4) x2 = x2 ^ r4 x1 = x1 ^ r5 # тут конец первой итерации x3, x4, x1,x2 = x1, x2, x3, x4 # определил, что для следующего блока нужно поменять местами переменные. Подсматриваем в эмуляторе write_u32(out_tab, 0, x3) # запись результата. Можно не сильно задумываться подсмотреть в эмуляторе порядок write_u32(out_tab, 4, x4) write_u32(out_tab, 8, x1) write_u32(out_tab, 12, x2)
Остается прошагать в эмуляторе, сравнить результат до sha, пройти второе выполнение вплоть до конечного:
В целом всё, осталось всё причесать и дело сделано. Приведу под спойлером из-за табличек. Сам код вышел очень компактным, если вспомнить какие портянки были в начале.
Итоговый вариант
import hashlib stack = bytearray(256) mem = bytearray(0x60) tab1 = bytes.fromhex( "29 89 A1 A8 05 85 81 84 16 C6 D2 D4 13 C3 D3 D0 14 44 50 54 1D 0D 11 1C 2C 8C A0 AC 25 05 21 24 1D 4D 51 5C 03 43 43 40 18 08 10 18 1E 0E 12 1C 11 41 51 50 3C CC F0 FC 0A CA C2 C8 23 43 63 60 28 08 20 28 04 44 40 44 20 00 20 20 1D 8D 91 9C 20 C0 E0 E0 22 C2 E2 E0 08 C8 C0 C8 17 07 13 14 25 85 A1 A4 0F 8F 83 8C 03 03 03 00 3B 4B 73 78 3B 8B B3 B8 13 03 13 10 12 C2 D2 D0 2E CE E2 EC 30 40 70 70 0C 8C 80 8C 3F 0F 33 3C 28 88 A0 A8 32 02 32 30 1D CD D1 DC 36 C6 F2 F4 34 44 70 74 2C CC E0 EC 15 85 91 94 0B 0B 03 08 17 47 53 54 1C 4C 50 5C 1B 4B 53 58 3D 8D B1 BC 01 01 01 00 24 04 20 24 1C 0C 10 1C 33 43 73 70 18 88 90 98 10 00 10 10 0C CC C0 CC 32 C2 F2 F0 19 C9 D1 D8 2C 0C 20 2C 27 C7 E3 E4 32 42 72 70 03 83 83 80 1B 8B 93 98 11 C1 D1 D0 06 86 82 84 09 C9 C1 C8 20 40 60 60 10 40 50 50 23 83 A3 A0 2B CB E3 E8 0D 0D 01 0C 36 86 B2 B4 1E 8E 92 9C 0F 4F 43 4C 37 87 B3 B4 1A 4A 52 58 06 C6 C2 C4 38 48 70 78 26 86 A2 A4 12 02 12 10 2F 8F A3 AC 15 C5 D1 D4 21 41 61 60 03 C3 C3 C0 34 84 B0 B4 01 41 41 40 12 42 52 50 3D 4D 71 7C 0D 8D 81 8C 08 08 00 08 1F 0F 13 1C 19 89 91 98 00 00 00 00 19 09 11 18 04 04 00 04 13 43 53 50 37 C7 F3 F4 21 C1 E1 E0 3D CD F1 FC 36 46 72 74 2F 0F 23 2C 27 07 23 24 30 80 B0 B0 0B 8B 83 88 0E 0E 02 0C 2B 8B A3 A8 22 82 A2 A0 2E 4E 62 6C 13 83 93 90 0D 4D 41 4C 29 49 61 68 3C 4C 70 7C 09 09 01 08 0A 0A 02 08 3F 8F B3 BC 2F CF E3 EC 33 C3 F3 F0 05 C5 C1 C4 07 87 83 84 14 04 10 14 3E CE F2 FC 24 44 60 64 1E CE D2 DC 2E 0E 22 2C 0B 4B 43 48 1A 0A 12 18 06 06 02 04 21 01 21 20 2B 4B 63 68 26 46 62 64 02 02 02 00 35 C5 F1 F4 12 82 92 90 0A 8A 82 88 0C 0C 00 0C 33 83 B3 B0 3E 4E 72 7C 10 C0 D0 D0 3A 4A 72 78 07 47 43 44 16 86 92 94 25 C5 E1 E4 26 06 22 24 00 80 80 80 2D 8D A1 AC 1F CF D3 DC 21 81 A1 A0 30 00 30 30 37 07 33 34 2E 8E A2 AC 36 06 32 34 15 05 11 14 22 02 22 20 38 08 30 38 34 C4 F0 F4 27 87 A3 A4 05 45 41 44 0C 4C 40 4C 01 81 81 80 29 C9 E1 E8 04 84 80 84 17 87 93 94 35 05 31 34 0B CB C3 C8 0E CE C2 CC 3C 0C 30 3C 31 41 71 70 11 01 11 10 07 C7 C3 C4 09 89 81 88 35 45 71 74 3B CB F3 F8 1A CA D2 D8 38 C8 F0 F8 14 84 90 94 19 49 51 58 02 82 82 80 04 C4 C0 C4 3F CF F3 FC 09 49 41 48 39 09 31 38 27 47 63 64 00 C0 C0 C0 0F CF C3 CC 17 C7 D3 D4 38 88 B0 B8 0F 0F 03 0C 0E 8E 82 8C 02 42 42 40 23 03 23 20 11 81 91 90 2C 4C 60 6C 1B CB D3 D8 24 84 A0 A4 34 04 30 34 31 C1 F1 F0 08 48 40 48 02 C2 C2 C0 2F 4F 63 6C 3D 0D 31 3C 2D 0D 21 2C 00 40 40 40 3E 8E B2 BC 3E 0E 32 3C 3C 8C B0 BC 01 C1 C1 C0 2A 8A A2 A8 3A 8A B2 B8 0E 4E 42 4C 15 45 51 54 3B 0B 33 38 1C CC D0 DC 28 48 60 68 3F 4F 73 7C 1C 8C 90 9C 18 C8 D0 D8 0A 4A 42 48 16 46 52 54 37 47 73 74 20 80 A0 A0 2D CD E1 EC 06 46 42 44 35 85 B1 B4 2B 0B 23 28 25 45 61 64 3A CA F2 F8 23 C3 E3 E0 39 89 B1 B8 31 81 B1 B0 1F 8F 93 9C 1E 4E 52 5C 39 C9 F1 F8 26 C6 E2 E4 32 82 B2 B0 31 01 31 30 2A CA E2 E8 2D 4D 61 6C 1F 4F 53 5C 24 C4 E0 E4 30 C0 F0 F0 0D CD C1 CC 08 88 80 88 16 06 12 14 3A 0A 32 38 18 48 50 58 14 C4 D0 D4 22 42 62 60 29 09 21 28 07 07 03 04 33 03 33 30 28 C8 E0 E8 1B 0B 13 18 05 05 01 04 39 49 71 78 10 80 90 90 2A 4A 62 68 2A 0A 22 28 1A 8A 92 98") tab2 = bytes.fromhex( "38 38 08 30 E8 28 C8 E0 2C 2D 0D 21 A4 26 86 A2 CC 0F CF C3 DC 1E CE D2 B0 33 83 B3 B8 38 88 B0 AC 2F 8F A3 60 20 40 60 54 15 45 51 C4 07 C7 C3 44 04 44 40 6C 2F 4F 63 68 2B 4B 63 58 1B 4B 53 C0 03 C3 C3 60 22 42 62 30 33 03 33 B4 35 85 B1 28 29 09 21 A0 20 80 A0 E0 22 C2 E2 A4 27 87 A3 D0 13 C3 D3 90 11 81 91 10 11 01 11 04 06 06 02 1C 1C 0C 10 BC 3C 8C B0 34 36 06 32 48 0B 4B 43 EC 2F CF E3 88 08 88 80 6C 2C 4C 60 A8 28 88 A0 14 17 07 13 C4 04 C4 C0 14 16 06 12 F4 34 C4 F0 C0 02 C2 C2 44 05 45 41 E0 21 C1 E1 D4 16 C6 D2 3C 3F 0F 33 3C 3D 0D 31 8C 0E 8E 82 98 18 88 90 28 28 08 20 4C 0E 4E 42 F4 36 C6 F2 3C 3E 0E 32 A4 25 85 A1 F8 39 C9 F1 0C 0D 0D 01 DC 1F CF D3 D8 18 C8 D0 28 2B 0B 23 64 26 46 62 78 3A 4A 72 24 27 07 23 2C 2F 0F 23 F0 31 C1 F1 70 32 42 72 40 02 42 42 D4 14 C4 D0 40 01 41 41 C0 00 C0 C0 70 33 43 73 64 27 47 63 AC 2C 8C A0 88 0B 8B 83 F4 37 C7 F3 AC 2D 8D A1 80 00 80 80 1C 1F 0F 13 C8 0A CA C2 2C 2C 0C 20 A8 2A 8A A2 34 34 04 30 D0 12 C2 D2 08 0B 0B 03 EC 2E CE E2 E8 29 C9 E1 5C 1D 4D 51 94 14 84 90 18 18 08 10 F8 38 C8 F0 54 17 47 53 AC 2E 8E A2 08 08 08 00 C4 05 C5 C1 10 13 03 13 CC 0D CD C1 84 06 86 82 B8 39 89 B1 FC 3F CF F3 7C 3D 4D 71 C0 01 C1 C1 30 31 01 31 F4 35 C5 F1 88 0A 8A 82 68 2A 4A 62 B0 31 81 B1 D0 11 C1 D1 20 20 00 20 D4 17 C7 D3 00 02 02 02 20 22 02 22 04 04 04 00 68 28 48 60 70 31 41 71 04 07 07 03 D8 1B CB D3 9C 1D 8D 91 98 19 89 91 60 21 41 61 BC 3E 8E B2 E4 26 C6 E2 58 19 49 51 DC 1D CD D1 50 11 41 51 90 10 80 90 DC 1C CC D0 98 1A 8A 92 A0 23 83 A3 A8 2B 8B A3 D0 10 C0 D0 80 01 81 81 0C 0F 0F 03 44 07 47 43 18 1A 0A 12 E0 23 C3 E3 EC 2C CC E0 8C 0D 8D 81 BC 3F 8F B3 94 16 86 92 78 3B 4B 73 5C 1C 4C 50 A0 22 82 A2 A0 21 81 A1 60 23 43 63 20 23 03 23 4C 0D 4D 41 C8 08 C8 C0 9C 1E 8E 92 9C 1C 8C 90 38 3A 0A 32 0C 0C 0C 00 2C 2E 0E 22 B8 3A 8A B2 6C 2E 4E 62 9C 1F 8F 93 58 1A 4A 52 F0 32 C2 F2 90 12 82 92 F0 33 C3 F3 48 09 49 41 78 38 48 70 CC 0C CC C0 14 15 05 11 F8 3B CB F3 70 30 40 70 74 35 45 71 7C 3F 4F 73 34 35 05 31 10 10 00 10 00 03 03 03 64 24 44 60 6C 2D 4D 61 C4 06 C6 C2 74 34 44 70 D4 15 C5 D1 B4 34 84 B0 E8 2A CA E2 08 09 09 01 74 36 46 72 18 19 09 11 FC 3E CE F2 40 00 40 40 10 12 02 12 E0 20 C0 E0 BC 3D 8D B1 04 05 05 01 F8 3A CA F2 00 01 01 01 F0 30 C0 F0 28 2A 0A 22 5C 1E 4E 52 A8 29 89 A1 54 16 46 52 40 03 43 43 84 05 85 81 14 14 04 10 88 09 89 81 98 1B 8B 93 B0 30 80 B0 E4 25 C5 E1 48 08 48 40 78 39 49 71 94 17 87 93 FC 3C CC F0 1C 1E 0E 12 80 02 82 82 20 21 01 21 8C 0C 8C 80 18 1B 0B 13 5C 1F 4F 53 74 37 47 73 54 14 44 50 B0 32 82 B2 1C 1D 0D 11 24 25 05 21 4C 0F 4F 43 00 00 00 00 44 06 46 42 EC 2D CD E1 58 18 48 50 50 12 42 52 E8 2B CB E3 7C 3E 4E 72 D8 1A CA D2 C8 09 C9 C1 FC 3D CD F1 30 30 00 30 94 15 85 91 64 25 45 61 3C 3C 0C 30 B4 36 86 B2 E4 24 C4 E0 B8 3B 8B B3 7C 3C 4C 70 0C 0E 0E 02 50 10 40 50 38 39 09 31 24 26 06 22 30 32 02 32 84 04 84 80 68 29 49 61 90 13 83 93 34 37 07 33 E4 27 C7 E3 24 24 04 20 A4 24 84 A0 C8 0B CB C3 50 13 43 53 08 0A 0A 02 84 07 87 83 D8 19 C9 D1 4C 0C 4C 40 80 03 83 83 8C 0F 8F 83 CC 0E CE C2 38 3B 0B 33 48 0A 4A 42 B4 37 87 B3") tab3 = bytes.fromhex( "A1 A8 29 89 81 84 05 85 D2 D4 16 C6 D3 D0 13 C3 50 54 14 44 11 1C 1D 0D A0 AC 2C 8C 21 24 25 05 51 5C 1D 4D 43 40 03 43 10 18 18 08 12 1C 1E 0E 51 50 11 41 F0 FC 3C CC C2 C8 0A CA 63 60 23 43 20 28 28 08 40 44 04 44 20 20 20 00 91 9C 1D 8D E0 E0 20 C0 E2 E0 22 C2 C0 C8 08 C8 13 14 17 07 A1 A4 25 85 83 8C 0F 8F 03 00 03 03 73 78 3B 4B B3 B8 3B 8B 13 10 13 03 D2 D0 12 C2 E2 EC 2E CE 70 70 30 40 80 8C 0C 8C 33 3C 3F 0F A0 A8 28 88 32 30 32 02 D1 DC 1D CD F2 F4 36 C6 70 74 34 44 E0 EC 2C CC 91 94 15 85 03 08 0B 0B 53 54 17 47 50 5C 1C 4C 53 58 1B 4B B1 BC 3D 8D 01 00 01 01 20 24 24 04 10 1C 1C 0C 73 70 33 43 90 98 18 88 10 10 10 00 C0 CC 0C CC F2 F0 32 C2 D1 D8 19 C9 20 2C 2C 0C E3 E4 27 C7 72 70 32 42 83 80 03 83 93 98 1B 8B D1 D0 11 C1 82 84 06 86 C1 C8 09 C9 60 60 20 40 50 50 10 40 A3 A0 23 83 E3 E8 2B CB 01 0C 0D 0D B2 B4 36 86 92 9C 1E 8E 43 4C 0F 4F B3 B4 37 87 52 58 1A 4A C2 C4 06 C6 70 78 38 48 A2 A4 26 86 12 10 12 02 A3 AC 2F 8F D1 D4 15 C5 61 60 21 41 C3 C0 03 C3 B0 B4 34 84 41 40 01 41 52 50 12 42 71 7C 3D 4D 81 8C 0D 8D 00 08 08 08 13 1C 1F 0F 91 98 19 89 00 00 00 00 11 18 19 09 00 04 04 04 53 50 13 43 F3 F4 37 C7 E1 E0 21 C1 F1 FC 3D CD 72 74 36 46 23 2C 2F 0F 23 24 27 07 B0 B0 30 80 83 88 0B 8B 02 0C 0E 0E A3 A8 2B 8B A2 A0 22 82 62 6C 2E 4E 93 90 13 83 41 4C 0D 4D 61 68 29 49 70 7C 3C 4C 01 08 09 09 02 08 0A 0A B3 BC 3F 8F E3 EC 2F CF F3 F0 33 C3 C1 C4 05 C5 83 84 07 87 10 14 14 04 F2 FC 3E CE 60 64 24 44 D2 DC 1E CE 22 2C 2E 0E 43 48 0B 4B 12 18 1A 0A 02 04 06 06 21 20 21 01 63 68 2B 4B 62 64 26 46 02 00 02 02 F1 F4 35 C5 92 90 12 82 82 88 0A 8A 00 0C 0C 0C B3 B0 33 83 72 7C 3E 4E D0 D0 10 C0 72 78 3A 4A 43 44 07 47 92 94 16 86 E1 E4 25 C5 22 24 26 06 80 80 00 80 A1 AC 2D 8D D3 DC 1F CF A1 A0 21 81 30 30 30 00 33 34 37 07 A2 AC 2E 8E 32 34 36 06 11 14 15 05 22 20 22 02 30 38 38 08 F0 F4 34 C4 A3 A4 27 87 41 44 05 45 40 4C 0C 4C 81 80 01 81 E1 E8 29 C9 80 84 04 84 93 94 17 87 31 34 35 05 C3 C8 0B CB C2 CC 0E CE 30 3C 3C 0C 71 70 31 41 11 10 11 01 C3 C4 07 C7 81 88 09 89 71 74 35 45 F3 F8 3B CB D2 D8 1A CA F0 F8 38 C8 90 94 14 84 51 58 19 49 82 80 02 82 C0 C4 04 C4 F3 FC 3F CF 41 48 09 49 31 38 39 09 63 64 27 47 C0 C0 00 C0 C3 CC 0F CF D3 D4 17 C7 B0 B8 38 88 03 0C 0F 0F 82 8C 0E 8E 42 40 02 42 23 20 23 03 91 90 11 81 60 6C 2C 4C D3 D8 1B CB A0 A4 24 84 30 34 34 04 F1 F0 31 C1 40 48 08 48 C2 C0 02 C2 63 6C 2F 4F 31 3C 3D 0D 21 2C 2D 0D 40 40 00 40 B2 BC 3E 8E 32 3C 3E 0E B0 BC 3C 8C C1 C0 01 C1 A2 A8 2A 8A B2 B8 3A 8A 42 4C 0E 4E 51 54 15 45 33 38 3B 0B D0 DC 1C CC 60 68 28 48 73 7C 3F 4F 90 9C 1C 8C D0 D8 18 C8 42 48 0A 4A 52 54 16 46 73 74 37 47 A0 A0 20 80 E1 EC 2D CD 42 44 06 46 B1 B4 35 85 23 28 2B 0B 61 64 25 45 F2 F8 3A CA E3 E0 23 C3 B1 B8 39 89 B1 B0 31 81 93 9C 1F 8F 52 5C 1E 4E F1 F8 39 C9 E2 E4 26 C6 B2 B0 32 82 31 30 31 01 E2 E8 2A CA 61 6C 2D 4D 53 5C 1F 4F E0 E4 24 C4 F0 F0 30 C0 C1 CC 0D CD 80 88 08 88 12 14 16 06 32 38 3A 0A 50 58 18 48 D0 D4 14 C4 62 60 22 42 21 28 29 09 03 04 07 07 33 30 33 03 E0 E8 28 C8 13 18 1B 0B 01 04 05 05 71 78 39 49 90 90 10 80 62 68 2A 4A 22 28 2A 0A 92 98 1A 8A") tab4 = bytes.fromhex( "08 30 38 38 C8 E0 E8 28 0D 21 2C 2D 86 A2 A4 26 CF C3 CC 0F CE D2 DC 1E 83 B3 B0 33 88 B0 B8 38 8F A3 AC 2F 40 60 60 20 45 51 54 15 C7 C3 C4 07 44 40 44 04 4F 63 6C 2F 4B 63 68 2B 4B 53 58 1B C3 C3 C0 03 42 62 60 22 03 33 30 33 85 B1 B4 35 09 21 28 29 80 A0 A0 20 C2 E2 E0 22 87 A3 A4 27 C3 D3 D0 13 81 91 90 11 01 11 10 11 06 02 04 06 0C 10 1C 1C 8C B0 BC 3C 06 32 34 36 4B 43 48 0B CF E3 EC 2F 88 80 88 08 4C 60 6C 2C 88 A0 A8 28 07 13 14 17 C4 C0 C4 04 06 12 14 16 C4 F0 F4 34 C2 C2 C0 02 45 41 44 05 C1 E1 E0 21 C6 D2 D4 16 0F 33 3C 3F 0D 31 3C 3D 8E 82 8C 0E 88 90 98 18 08 20 28 28 4E 42 4C 0E C6 F2 F4 36 0E 32 3C 3E 85 A1 A4 25 C9 F1 F8 39 0D 01 0C 0D CF D3 DC 1F C8 D0 D8 18 0B 23 28 2B 46 62 64 26 4A 72 78 3A 07 23 24 27 0F 23 2C 2F C1 F1 F0 31 42 72 70 32 42 42 40 02 C4 D0 D4 14 41 41 40 01 C0 C0 C0 00 43 73 70 33 47 63 64 27 8C A0 AC 2C 8B 83 88 0B C7 F3 F4 37 8D A1 AC 2D 80 80 80 00 0F 13 1C 1F CA C2 C8 0A 0C 20 2C 2C 8A A2 A8 2A 04 30 34 34 C2 D2 D0 12 0B 03 08 0B CE E2 EC 2E C9 E1 E8 29 4D 51 5C 1D 84 90 94 14 08 10 18 18 C8 F0 F8 38 47 53 54 17 8E A2 AC 2E 08 00 08 08 C5 C1 C4 05 03 13 10 13 CD C1 CC 0D 86 82 84 06 89 B1 B8 39 CF F3 FC 3F 4D 71 7C 3D C1 C1 C0 01 01 31 30 31 C5 F1 F4 35 8A 82 88 0A 4A 62 68 2A 81 B1 B0 31 C1 D1 D0 11 00 20 20 20 C7 D3 D4 17 02 02 00 02 02 22 20 22 04 00 04 04 48 60 68 28 41 71 70 31 07 03 04 07 CB D3 D8 1B 8D 91 9C 1D 89 91 98 19 41 61 60 21 8E B2 BC 3E C6 E2 E4 26 49 51 58 19 CD D1 DC 1D 41 51 50 11 80 90 90 10 CC D0 DC 1C 8A 92 98 1A 83 A3 A0 23 8B A3 A8 2B C0 D0 D0 10 81 81 80 01 0F 03 0C 0F 47 43 44 07 0A 12 18 1A C3 E3 E0 23 CC E0 EC 2C 8D 81 8C 0D 8F B3 BC 3F 86 92 94 16 4B 73 78 3B 4C 50 5C 1C 82 A2 A0 22 81 A1 A0 21 43 63 60 23 03 23 20 23 4D 41 4C 0D C8 C0 C8 08 8E 92 9C 1E 8C 90 9C 1C 0A 32 38 3A 0C 00 0C 0C 0E 22 2C 2E 8A B2 B8 3A 4E 62 6C 2E 8F 93 9C 1F 4A 52 58 1A C2 F2 F0 32 82 92 90 12 C3 F3 F0 33 49 41 48 09 48 70 78 38 CC C0 CC 0C 05 11 14 15 CB F3 F8 3B 40 70 70 30 45 71 74 35 4F 73 7C 3F 05 31 34 35 00 10 10 10 03 03 00 03 44 60 64 24 4D 61 6C 2D C6 C2 C4 06 44 70 74 34 C5 D1 D4 15 84 B0 B4 34 CA E2 E8 2A 09 01 08 09 46 72 74 36 09 11 18 19 CE F2 FC 3E 40 40 40 00 02 12 10 12 C0 E0 E0 20 8D B1 BC 3D 05 01 04 05 CA F2 F8 3A 01 01 00 01 C0 F0 F0 30 0A 22 28 2A 4E 52 5C 1E 89 A1 A8 29 46 52 54 16 43 43 40 03 85 81 84 05 04 10 14 14 89 81 88 09 8B 93 98 1B 80 B0 B0 30 C5 E1 E4 25 48 40 48 08 49 71 78 39 87 93 94 17 CC F0 FC 3C 0E 12 1C 1E 82 82 80 02 01 21 20 21 8C 80 8C 0C 0B 13 18 1B 4F 53 5C 1F 47 73 74 37 44 50 54 14 82 B2 B0 32 0D 11 1C 1D 05 21 24 25 4F 43 4C 0F 00 00 00 00 46 42 44 06 CD E1 EC 2D 48 50 58 18 42 52 50 12 CB E3 E8 2B 4E 72 7C 3E CA D2 D8 1A C9 C1 C8 09 CD F1 FC 3D 00 30 30 30 85 91 94 15 45 61 64 25 0C 30 3C 3C 86 B2 B4 36 C4 E0 E4 24 8B B3 B8 3B 4C 70 7C 3C 0E 02 0C 0E 40 50 50 10 09 31 38 39 06 22 24 26 02 32 30 32 84 80 84 04 49 61 68 29 83 93 90 13 07 33 34 37 C7 E3 E4 27 04 20 24 24 84 A0 A4 24 CB C3 C8 0B 43 53 50 13 0A 02 08 0A 87 83 84 07 C9 D1 D8 19 4C 40 4C 0C 83 83 80 03 8F 83 8C 0F CE C2 CC 0E 0B 33 38 3B 4A 42 48 0A 87 B3 B4 37") tabs = (tab1,tab2,tab3,tab4) def dump(tab,start, ln): for offset in range(start, start + ln, 16): chunk = tab[offset:offset + 16] print(f"{hex(offset)}: {' '.join(f'{b:02X}' for b in chunk)}") def write_u32(tab, addr, value): tab[addr+3 ] = value & 0xff tab[addr+2] = (value>>8) & 0xff tab[addr+1] = (value>>16) & 0xff tab[addr+0] = (value>>24) & 0xff def read_u32(tab, addr): res = tab[addr] res = res << 8 | tab[addr+1] res = res << 8 | tab[addr+2] res = res << 8 | tab[addr+3] return res def F_func(v, tabs): return (read_u32(tabs[0], (v & 0xFF) * 4) ^ read_u32(tabs[1], ((v >> 8) & 0xFF) * 4) ^ read_u32(tabs[2], ((v >> 16) & 0xFF) * 4) ^ read_u32(tabs[3], ((v >> 24) & 0xFF) * 4)) def _encrypt( reg_tab, out_tab, key_tab, tabs): def round3(a, b): f1 = F_func(b, tabs) b = (a + f1) & 0xFFFFFFFF f2 = F_func(b, tabs) a = (f1 + f2) & 0xFFFFFFFF f3 = F_func(a, tabs) b = (f2 + f3) & 0xFFFFFFFF return f3, b x1 = read_u32(reg_tab, 0) x2 = read_u32(reg_tab, 4) x3 = read_u32(reg_tab, 8) x4 = read_u32(reg_tab, 12) for adr in range(0, 0x7c, 8): k0 = read_u32(key_tab, adr) k1 = read_u32(key_tab, adr + 4) r5 = k0 ^ x3 r4 = k1 ^ x4 ^ r5 r4, r5 = round3(r5, r4) x2 = x2 ^ r4 x1 = x1 ^ r5 x3, x4, x1,x2 = x1, x2, x3, x4 write_u32(out_tab, 0, x3) write_u32(out_tab, 4, x4) write_u32(out_tab, 8, x1) write_u32(out_tab, 12, x2) return out_tab def sub_1DBE83C (r0, r1, r2): global stack, mem, tabs stack = bytes.fromhex("00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C 00 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 DB E8 78 26 8D 66 A7 35 A8 1A 81 6F BA D9 FA 36 16 25 01 D0 73 01 5C 3C 75 4B C2 C1 8C E9 4A B0 D1 0F 3E 66 77 6C A4 F2 B2 13 98 54 B8 D9 E1 F6 6B DA B9 A3 AD BD 1D 9E 01 71 88 D7 E5 4E 81 17 55 68 9A 43 3E 6A C5 E8 F9 02 45 69 B3 F0 E1 DA C4 66 26 51 25 CB 71 67 00 14 9D BE 61 36 3F 1D 4E 08 C4 61 E8 31 C6 21 83 42 9D 4C 42 5E 6F CE DF 8A C0 01 D8 D7 61 DA DC E0 E8 FA F9 5C C0 94 3A CC E4 91 FA 00 C8 7A B8 39 1F 51 CF CC 6C 4C 7E 83 ED 65 43 97 31 9B 48 13 C1 2F A9 69 0A CA 04 F3 50 00 00 00 00 00 00 00 00 02 03 D6 54") out_tab = _encrypt( reg_tab=mem[r0:r0+0x10], out_tab=mem[r1:r1+0x10], key_tab=stack[0x74:0xff], tabs = tabs) mem[r1:r1+0x10] = out_tab[0x0:0x10] def generate_passwords(serial_hex): global mem sn_bytes = bytes.fromhex(serial_hex) if not((sn_bytes[6]==0x90) & (sn_bytes[7]==0x1B)): print ("not ss02-1 crum") return bytes.fromhex("00"), bytes.fromhex("00") mem[0x50:0x58] = sn_bytes mem[0x58:0x5E] = b"SECPRT" mem[0x5E] = 0 mem[0x5F] = 0 for r0 in range(8): mem[0x5E] = mem[0x5E] ^ mem[0x50 + r0] mem[0x5F] = mem[0x5F] ^ mem[0x50 + (r0 << 1)] sub_1DBE83C (r0 = 0x50, r1 = 0x3c,r2 = 0x10) block_2 = mem[0x3C:0x4C] hash_2 = hashlib.sha1(block_2).digest() mem[0x10:0x24] = hash_2 mem [0x24:0x2c] = mem[0x18:0x20] sub_1DBE83C (r0 = 0x10, r1 = 0x0,r2 = 0x10) mem[0x2c:0x2c+8] = mem[0x8:0x10] auth_pass = mem[0x2c:0x2C+8] write_pass = mem[0x24:0x27] #print("Дамп:") #dump (mem, 0x0, 16*16) return auth_pass, write_pass serial = input("SN:") auth, write = generate_passwords(serial) print(f"Входной SN: {serial}") print(f"Auth Pass: {auth.hex().upper()}") print(f"Write Pass: {write.hex().upper()}")
Результат:
SN:112233445566901B Входной SN: 112233445566901B Auth Pass: 391B22CD6DD7B5C4 Write Pass: 26851F
Сошлось )
Так же решил посмотреть результат дизасемлирования через ghidra_12.1.2_PUBLIC. Вот так выглядит функция 01dbe83c:
void FUN_01dbe83c(undefined4 param_1,undefined4 param_2,undefined4 param_3) { undefined4 local_9c; undefined4 uStack_98; undefined4 uStack_94; undefined4 uStack_90; undefined1 auStack_8c [128]; local_9c = *DAT_01dbe890; uStack_98 = DAT_01dbe890[1]; uStack_94 = DAT_01dbe890[2]; uStack_90 = DAT_01dbe890[3]; FUN_01dbc554(&local_9c,auStack_8c,param_3,DAT_01dbe894[1],*DAT_01dbe894,DAT_01dbe894[1], DAT_01dbe894[2],DAT_01dbe894[3]); FUN_01dbcef0(param_1,param_2,auStack_8c); return;
Первая 1DBC554, которую в итоге делать не пришлось:
FUN_01dbc554
void FUN_01dbc554(byte *param_1,uint *param_2) { int iVar1; int iVar2; int iVar3; int iVar4; uint uVar5; uint uVar6; uint uVar7; uint uVar8; uint uVar9; iVar4 = DAT_01dbceec; iVar3 = DAT_01dbcee8; iVar2 = DAT_01dbcee4; iVar1 = DAT_01dbcee0; uVar7 = (uint)*param_1; uVar6 = (uint)param_1[2]; uVar8 = (uint)param_1[1]; uVar9 = (uint)param_1[3]; uVar5 = uVar7 + uVar6 + 0x61c88647; *param_2 = *(uint *)(DAT_01dbcee0 + (uVar5 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar5 >> 0x18) * 4); uVar5 = (uVar8 - uVar9) + 0x9e3779b9; param_2[1] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = uVar8 * 0x1000000 + uVar6 + 0xc3910c8d; param_2[2] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = (uVar7 * 0x1000000 - uVar9) + 0x3c6ef373; param_2[3] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = uVar8 * 0x1000000 + uVar6 * 0x100 + 0x8722191a; param_2[4] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = uVar7 * 0x1000000 + uVar9 * -0x100 + 0x78dde6e6; param_2[5] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = uVar8 * 0x10000 + uVar6 * 0x100 + 0xe443234; param_2[6] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = uVar7 * 0x10000 + uVar9 * -0x100 + 0xf1bbcdcc; param_2[7] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = uVar8 * 0x10000 + uVar6 * 0x10000 + 0x1c886467; param_2[8] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = uVar7 * 0x10000 + uVar9 * -0x10000 + 0xe3779b99; param_2[9] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = uVar8 * 0x100 + uVar6 * 0x10000 + 0x3910c8cd; param_2[10] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = uVar7 * 0x100 + uVar9 * -0x10000 + 0xc6ef3733; param_2[0xb] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = uVar8 * 0x100 + uVar6 * 0x1000000 + 0x72219199; param_2[0xc] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = uVar7 * 0x100 + uVar9 * -0x1000000 + 0x8dde6e67; param_2[0xd] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = uVar8 + uVar6 * 0x1000000 + 0xe4432331; param_2[0xe] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = uVar7 + uVar9 * -0x1000000 + 0x1bbcdccf; param_2[0xf] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = uVar8 + uVar9 + 0xc8864662; param_2[0x10] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = (uVar7 - uVar6) + 0x3779b99e; param_2[0x11] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = uVar7 * 0x1000000 + uVar9 + 0x910c8cc4; param_2[0x12] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = (uVar8 * 0x1000000 - uVar6) + 0x6ef3733c; param_2[0x13] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = uVar7 * 0x1000000 + uVar9 * 0x100 + 0x22191988; param_2[0x14] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = uVar8 * 0x1000000 + uVar6 * -0x100 + 0xdde6e678; param_2[0x15] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = uVar7 * 0x10000 + uVar9 * 0x100 + 0x4432330f; param_2[0x16] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = uVar8 * 0x10000 + uVar6 * -0x100 + 0xbbcdccf1; param_2[0x17] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = uVar7 * 0x10000 + uVar9 * 0x10000 + 0x8864661d; param_2[0x18] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = uVar8 * 0x10000 + uVar6 * -0x10000 + 0x779b99e3; param_2[0x19] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = uVar7 * 0x100 + uVar9 * 0x10000 + 0x10c8cc3a; param_2[0x1a] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = uVar8 * 0x100 + uVar6 * -0x10000 + 0xef3733c6; param_2[0x1b] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = uVar7 * 0x100 + uVar9 * 0x1000000 + 0x21919873; param_2[0x1c] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = uVar8 * 0x100 + uVar6 * -0x1000000 + 0xde6e678d; param_2[0x1d] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = uVar7 + uVar9 * 0x1000000 + 0x432330e5; param_2[0x1e] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); uVar5 = uVar8 + uVar6 * -0x1000000 + 0xbcdccf1b; param_2[0x1f] = *(uint *)(iVar1 + (uVar5 & 0xff) * 4) ^ *(uint *)(iVar2 + (uVar5 >> 8 & 0xff) * 4) ^ *(uint *)(iVar3 + (uVar5 >> 0x10 & 0xff) * 4) ^ *(uint *)(iVar4 + (uVar5 >> 0x18) * 4); return;
Вторая:
FUN_01dbcef0
undefined4 FUN_01dbcef0(uint *param_1,uint *param_2,uint *param_3) { uint uVar1; uint uVar2; uint uVar3; uint uVar4; uint uVar5; uint uVar6; uint uVar7; uint uVar8; uint uVar9; uint uVar10; uVar3 = param_1[2] ^ *param_3; uVar1 = param_3[1] ^ param_1[3] ^ uVar3; uVar1 = *(uint *)(DAT_01dbcee0 + (uVar1 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar1 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar1 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar1 >> 0x18) * 4); uVar3 = uVar3 + uVar1; uVar4 = *(uint *)(DAT_01dbcee0 + (uVar3 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar3 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar3 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar3 >> 0x18) * 4); uVar1 = uVar1 + uVar4; uVar1 = *(uint *)(DAT_01dbcee0 + (uVar1 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar1 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar1 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar1 >> 0x18) * 4); uVar3 = param_1[1] ^ uVar1; uVar6 = *param_1 ^ uVar4 + uVar1; uVar4 = param_3[2] ^ uVar6; uVar1 = param_3[3] ^ uVar3 ^ uVar4; uVar1 = *(uint *)(DAT_01dbcee0 + (uVar1 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar1 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar1 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar1 >> 0x18) * 4); uVar4 = uVar4 + uVar1; uVar4 = *(uint *)(DAT_01dbcee0 + (uVar4 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar4 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar4 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar4 >> 0x18) * 4); uVar1 = uVar1 + uVar4; uVar2 = *(uint *)(DAT_01dbcee0 + (uVar1 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar1 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar1 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar1 >> 0x18) * 4); uVar7 = param_1[2] ^ uVar4 + uVar2; uVar2 = param_1[3] ^ uVar2; uVar4 = param_3[4] ^ uVar7; uVar1 = param_3[5] ^ uVar2 ^ uVar4; uVar1 = *(uint *)(DAT_01dbcee0 + (uVar1 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar1 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar1 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar1 >> 0x18) * 4); uVar4 = uVar4 + uVar1; uVar4 = *(uint *)(DAT_01dbcee0 + (uVar4 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar4 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar4 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar4 >> 0x18) * 4); uVar1 = uVar1 + uVar4; uVar1 = *(uint *)(DAT_01dbcee0 + (uVar1 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar1 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar1 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar1 >> 0x18) * 4); uVar3 = uVar3 ^ uVar1; uVar6 = uVar6 ^ uVar4 + uVar1; uVar4 = param_3[6] ^ uVar6; uVar1 = param_3[7] ^ uVar3 ^ uVar4; uVar1 = *(uint *)(DAT_01dbcee0 + (uVar1 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar1 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar1 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar1 >> 0x18) * 4); uVar4 = uVar4 + uVar1; uVar4 = *(uint *)(DAT_01dbcee0 + (uVar4 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar4 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar4 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar4 >> 0x18) * 4); uVar1 = uVar1 + uVar4; uVar1 = *(uint *)(DAT_01dbcee0 + (uVar1 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar1 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar1 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar1 >> 0x18) * 4); uVar7 = uVar7 ^ uVar4 + uVar1; uVar2 = uVar2 ^ uVar1; uVar4 = param_3[8] ^ uVar7; uVar1 = param_3[9] ^ uVar2 ^ uVar4; uVar1 = *(uint *)(DAT_01dbcee0 + (uVar1 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar1 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar1 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar1 >> 0x18) * 4); uVar4 = uVar4 + uVar1; uVar4 = *(uint *)(DAT_01dbcee0 + (uVar4 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar4 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar4 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar4 >> 0x18) * 4); uVar1 = uVar1 + uVar4; uVar1 = *(uint *)(DAT_01dbcee0 + (uVar1 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar1 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar1 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar1 >> 0x18) * 4); uVar6 = uVar6 ^ uVar4 + uVar1; uVar3 = uVar3 ^ uVar1; uVar4 = param_3[10] ^ uVar6; uVar1 = param_3[0xb] ^ uVar3 ^ uVar4; uVar1 = *(uint *)(DAT_01dbcee0 + (uVar1 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar1 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar1 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar1 >> 0x18) * 4); uVar4 = uVar4 + uVar1; uVar4 = *(uint *)(DAT_01dbcee0 + (uVar4 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar4 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar4 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar4 >> 0x18) * 4); uVar1 = uVar1 + uVar4; uVar1 = *(uint *)(DAT_01dbcee0 + (uVar1 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar1 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar1 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar1 >> 0x18) * 4); uVar7 = uVar7 ^ uVar4 + uVar1; uVar2 = uVar2 ^ uVar1; uVar4 = param_3[0xc] ^ uVar7; uVar1 = param_3[0xd] ^ uVar2 ^ uVar4; uVar1 = *(uint *)(DAT_01dbcee0 + (uVar1 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar1 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar1 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar1 >> 0x18) * 4); uVar4 = uVar4 + uVar1; uVar4 = *(uint *)(DAT_01dbcee0 + (uVar4 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar4 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar4 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar4 >> 0x18) * 4); uVar1 = uVar1 + uVar4; uVar1 = *(uint *)(DAT_01dbcee0 + (uVar1 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar1 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar1 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar1 >> 0x18) * 4); uVar3 = uVar3 ^ uVar1; uVar6 = uVar6 ^ uVar4 + uVar1; uVar4 = param_3[0xe] ^ uVar6; uVar1 = param_3[0xf] ^ uVar3 ^ uVar4; uVar1 = *(uint *)(DAT_01dbcee0 + (uVar1 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar1 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar1 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar1 >> 0x18) * 4); uVar4 = uVar4 + uVar1; uVar4 = *(uint *)(DAT_01dbcee0 + (uVar4 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar4 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar4 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar4 >> 0x18) * 4); uVar1 = uVar1 + uVar4; uVar1 = *(uint *)(DAT_01dbcee0 + (uVar1 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar1 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar1 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar1 >> 0x18) * 4); uVar7 = uVar7 ^ uVar4 + uVar1; uVar2 = uVar2 ^ uVar1; uVar1 = param_3[0x10] ^ uVar7; uVar4 = param_3[0x11] ^ uVar2 ^ uVar1; uVar4 = *(uint *)(DAT_01dbcee0 + (uVar4 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar4 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar4 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar4 >> 0x18) * 4); uVar1 = uVar1 + uVar4; uVar1 = *(uint *)(DAT_01dbcee0 + (uVar1 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar1 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar1 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar1 >> 0x18) * 4); uVar4 = uVar4 + uVar1; uVar4 = *(uint *)(DAT_01dbcee0 + (uVar4 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar4 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar4 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar4 >> 0x18) * 4); uVar6 = uVar6 ^ uVar1 + uVar4; uVar3 = uVar3 ^ uVar4; uVar4 = param_3[0x12] ^ uVar6; uVar1 = param_3[0x13] ^ uVar3 ^ uVar4; uVar1 = *(uint *)(DAT_01dbcee0 + (uVar1 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar1 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar1 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar1 >> 0x18) * 4); uVar4 = uVar4 + uVar1; uVar4 = *(uint *)(DAT_01dbcee0 + (uVar4 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar4 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar4 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar4 >> 0x18) * 4); uVar1 = uVar1 + uVar4; uVar1 = *(uint *)(DAT_01dbcee0 + (uVar1 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar1 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar1 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar1 >> 0x18) * 4); uVar7 = uVar7 ^ uVar4 + uVar1; uVar2 = uVar2 ^ uVar1; uVar1 = param_3[0x14] ^ uVar7; uVar4 = param_3[0x15] ^ uVar2 ^ uVar1; uVar4 = *(uint *)(DAT_01dbcee0 + (uVar4 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar4 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar4 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar4 >> 0x18) * 4); uVar1 = uVar1 + uVar4; uVar1 = *(uint *)(DAT_01dbcee0 + (uVar1 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar1 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar1 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar1 >> 0x18) * 4); uVar4 = uVar4 + uVar1; uVar4 = *(uint *)(DAT_01dbcee0 + (uVar4 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar4 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar4 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar4 >> 0x18) * 4); uVar6 = uVar6 ^ uVar1 + uVar4; uVar3 = uVar3 ^ uVar4; uVar1 = param_3[0x16] ^ uVar6; uVar4 = param_3[0x17] ^ uVar3 ^ uVar1; uVar4 = *(uint *)(DAT_01dbcee0 + (uVar4 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar4 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar4 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar4 >> 0x18) * 4); uVar1 = uVar1 + uVar4; uVar1 = *(uint *)(DAT_01dbcee0 + (uVar1 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar1 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar1 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar1 >> 0x18) * 4); uVar4 = uVar4 + uVar1; uVar4 = *(uint *)(DAT_01dbcee0 + (uVar4 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar4 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar4 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar4 >> 0x18) * 4); uVar7 = uVar7 ^ uVar1 + uVar4; uVar2 = uVar2 ^ uVar4; uVar1 = param_3[0x18] ^ uVar7; uVar4 = param_3[0x19] ^ uVar2 ^ uVar1; uVar4 = *(uint *)(DAT_01dbcee0 + (uVar4 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar4 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar4 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar4 >> 0x18) * 4); uVar1 = uVar1 + uVar4; uVar1 = *(uint *)(DAT_01dbcee0 + (uVar1 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar1 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar1 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar1 >> 0x18) * 4); uVar4 = uVar4 + uVar1; uVar4 = *(uint *)(DAT_01dbcee0 + (uVar4 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar4 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar4 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar4 >> 0x18) * 4); uVar6 = uVar6 ^ uVar1 + uVar4; uVar3 = uVar3 ^ uVar4; uVar4 = param_3[0x1a] ^ uVar6; uVar1 = param_3[0x1b] ^ uVar3 ^ uVar4; uVar1 = *(uint *)(DAT_01dbcee0 + (uVar1 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar1 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar1 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar1 >> 0x18) * 4); uVar4 = uVar4 + uVar1; uVar4 = *(uint *)(DAT_01dbcee0 + (uVar4 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar4 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar4 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar4 >> 0x18) * 4); uVar1 = uVar1 + uVar4; uVar1 = *(uint *)(DAT_01dbcee0 + (uVar1 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar1 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar1 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar1 >> 0x18) * 4); uVar7 = uVar7 ^ uVar4 + uVar1; uVar2 = uVar2 ^ uVar1; uVar4 = param_3[0x1c] ^ uVar7; uVar1 = param_3[0x1d] ^ uVar2 ^ uVar4; uVar1 = *(uint *)(DAT_01dbcee0 + (uVar1 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar1 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar1 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar1 >> 0x18) * 4); uVar4 = uVar4 + uVar1; uVar4 = *(uint *)(DAT_01dbcee0 + (uVar4 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar4 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar4 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar4 >> 0x18) * 4); uVar1 = uVar1 + uVar4; uVar1 = *(uint *)(DAT_01dbcee0 + (uVar1 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar1 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar1 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar1 >> 0x18) * 4); uVar6 = uVar6 ^ uVar4 + uVar1; uVar3 = uVar3 ^ uVar1; uVar4 = param_3[0x1e] ^ uVar6; uVar1 = param_3[0x1f] ^ uVar3 ^ uVar4; uVar5 = *(uint *)(DAT_01dbcee0 + (uVar1 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar1 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar1 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar1 >> 0x18) * 4); uVar4 = uVar4 + uVar5; uVar1 = *(uint *)(DAT_01dbcee0 + (uVar4 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee4 + (uVar4 >> 8 & 0xff) * 4) ^ *(uint *)(DAT_01dbcee8 + (uVar4 >> 0x10 & 0xff) * 4) ^ *(uint *)(DAT_01dbceec + (uVar4 >> 0x18) * 4); uVar5 = uVar5 + uVar1; uVar8 = *(uint *)(DAT_01dbcee0 + (uVar5 & 0xff) * 4); uVar10 = *(uint *)(DAT_01dbcee4 + (uVar5 >> 8 & 0xff) * 4); uVar9 = *(uint *)(DAT_01dbcee8 + (uVar5 >> 0x10 & 0xff) * 4); uVar4 = *(uint *)(DAT_01dbceec + (uVar5 >> 0x18) * 4); param_2[3] = uVar3; uVar4 = uVar8 ^ uVar10 ^ uVar9 ^ uVar4; *param_2 = uVar7 ^ uVar1 + uVar4; param_2[1] = uVar2 ^ uVar4; param_2[2] = uVar6; return 0; }
Очень круто на самом деле! Буквально итерация перед сворачиванием цикла! Очень информативно. Наверное можно загрузить в ИИ-шку с просьбой перевести на питон, объяснить что такое DAT_01dbcee0 и т.д. ) Возможно отладка станет дольше, а может и нет, кто знает.
На этом всё, надеюсь получилось поделиться полезными инструментами и подходом! Спасибо за внимание!
