0

While running Hex-Rays decompiler against an application, Hex-Rays gave the following output:

__int64 v29; // r10 ... v29 = 0i64; if( !v28) v19 = 0; do { v30 = *(_BYTE *)(v29 + 5394926180i64); v31 = *(_BYTE *)(v29 + 5394926172i64); v32 = *(_BYTE *)(v29 + 5394926184i64); v33 = *(_BYTE *)(v29 + 5394926176i64); v34 = *(_BYTE *)(v29++ + 5394926224i64); v75.m128i_i8[v29 + 15] = v30 ^ v34; *((_BYTE *)&v76 + v29 + 3) = v31 ^ *(_BYTE *)(v29 + 5394926227i64); *((_BYTE *)&v76 + v29 + 7) = v32 ^ *(_BYTE *)(v29 + 5394926231i64); *((_BYTE *)&v76 + v29 + 11) = v33 ^ *(_BYTE *)(v29 + 5394926235i64); *((_BYTE *)&v74 + v29 + 15) = v30 ^ *(_BYTE *)(v29 + 5394926239i64); v75.m128i_i8[v29 + 3] = v31 ^ *(_BYTE *)(v29 + 5394926243i64); v75.m128i_i8[v29 + 7] = v32 ^ *(_BYTE *)(v29 + 5394926247i64); v75.m128i_i8[v29 + 11] = v33 ^ *(_BYTE *)(v29 + 5394926251i64); } while ( v29 < 4 );

I'm confused about the references:

*((_BYTE *)&v76 + v29 + 3) = v31 ^ *(_BYTE *)(v29 + 5394926227i64); *((_BYTE *)&v76 + v29 + 7) = v32 ^ *(_BYTE *)(v29 + 5394926231i64); *((_BYTE *)&v76 + v29 + 11) = v33 ^ *(_BYTE *)(v29 + 5394926235i64); *((_BYTE *)&v74 + v29 + 15) = v30 ^ *(_BYTE *)(v29 + 5394926239i64);

These seem to be well outside the realm of any possible array? Am I missing something?

Improve this question
1
  • Can you post an assembly code related to one of those offsets ? Commented Nov 20, 2017 at 7:23

2 Answers 2

Reset to default
1

It looks like you're dealing with constant address around 5394926180i64 (0x141900a64) and v29 looks like an index in the array of structures. I'd say that it looks like kind of work with memory mapped registers - I had seen such a things before with various IOT devices ROMs . I'd suggest to do the following:

  • Verify that you have a segment that includes the address. If not - create additional data segment that includes all mentioned addresses.
  • Mark the suspicious number as offsets (just press O on them).

This should cause IDA to threat all these things as offsets in memory.

If this is low level code that deals with hardware directly you'll probably find all segment addresses either in it SDK or in the corresponding datasheet.

Improve this answer
1
  • In this case it isn't low-level code but just a Windows application. Commented Nov 20, 2017 at 18:25
0

Appears I may have figured it out. In this case, it's just dereferencing offsets from 0 which ultimately point to some data in .rdata. I hadn't realized it until I modified the number representation to hex.

Improve this answer

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.