Thread: Crypto or not?
View Single Post
  #1  
Old 11-17-2004, 19:40
djneo
 
Posts: n/a
Crypto or not?

it's the second time I see this sort of code and I don't know if this is a crypto algo or not.

It's always a function wich is call several times.
example :

0041901F |> 8B4C24 14 /MOV ECX,DWORD PTR SS:[ESP+14]
00419023 |> 8D441C 20 LEA EAX,DWORD PTR SS:[ESP+EBX+20]
00419027 |. 0FB63C08 |MOVZX EDI,BYTE PTR DS:[EAX+ECX]
0041902B |. 33D2 |XOR EDX,EDX
0041902D |. 8BF0 |MOV ESI,EAX
0041902F |. 90 |NOP
00419030 |> 8B4424 40 |/MOV EAX,DWORD PTR SS:[ESP+40]
00419034 |. 0FB60402 ||MOVZX EAX,BYTE PTR DS:[EDX+EAX]
00419038 0FAFC7 IMUL EAX,EDI
0041903B |. 85C0 ||TEST EAX,EAX
0041903D |. 74 13 ||JE SHORT 00419052
0041903F |. 8BCE ||MOV ECX,ESI
00419041 |> 0FB629 ||/MOVZX EBP,BYTE PTR DS:[ECX]
00419044 |. 03C5 |||ADD EAX,EBP
00419046 |. 8801 |||MOV BYTE PTR DS:[ECX],AL
00419048 |. C1E8 08 |||SHR EAX,8
0041904B |. 83C1 01 |||ADD ECX,1
0041904E |. 85C0 |||TEST EAX,EAX
00419050 |.^ 75 EF ||\JNZ SHORT 00419041
00419052 |> 83C2 01 ||ADD EDX,1
00419055 |. 83C6 01 ||ADD ESI,1
00419058 |. 83FA 08 ||CMP EDX,8
0041905B |.^ 7C D3 |\JL SHORT 00419030
0041905D |. 83C3 01 |ADD EBX,1
00419060 |. 83FB 08 |CMP EBX,8
00419063 |.^ 7C BA \JL SHORT 0041901F

Someone recognize this algo and it is possible to reverse it?

Thank you
Reply With Quote