Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 06-16-2011, 03:25
Kerlingen Kerlingen is offline
VIP
 
Join Date: Feb 2011
Posts: 342
Rept. Given: 0
Rept. Rcvd 278 Times in 100 Posts
Thanks Given: 0
Thanks Rcvd at 361 Times in 112 Posts
Kerlingen Reputation: 200-299 Kerlingen Reputation: 200-299 Kerlingen Reputation: 200-299
I didn't know GMP before, but I tried to find you code in GMP4 and GMP5. I tried finding the "ror" part, since I think it's very unusual.

The source doesn't contain any matching "ror" in the *.asm files.
The source doesn't contain any matching pseudo-C "ror" like "(x>>n | x<<32-n)" in any file.
The compiled GMP4 and GMP5 libraries don't contain any "ror" instruction.

Maybe it's a different GMP version or different compiler settings where used.

I think the function doesn't modify a "mpf_ptr" structure, the arithmetic operations don't really fit the structure.
Reply With Quote
  #2  
Old 06-16-2011, 05:56
Kerlingen Kerlingen is offline
VIP
 
Join Date: Feb 2011
Posts: 342
Rept. Given: 0
Rept. Rcvd 278 Times in 100 Posts
Thanks Given: 0
Thanks Rcvd at 361 Times in 112 Posts
Kerlingen Reputation: 200-299 Kerlingen Reputation: 200-299 Kerlingen Reputation: 200-299
Code:
_C = D + A - ROR(B, 5)
_A = ROR(C, 15) xor B
_B = C + D
_D = A - ROR(B, 5) + ROR(C, 15) xor B
A = _A
B = _B
C = _C
D = _D
This looks like the inner loop of some hash or crypto function.

A "mpz_struct" doesn't fit either. Both structures contain a pointer and XORing pointers isn't the best idea, even if adding or subtracting is sometimes used with pointers. Do you have a link to the code you're analysing? Just this one code fragment doesn't show much.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
IDA script function. Git General Discussion 6 09-24-2014 01:58
FUNCTION CHUNKs Git General Discussion 4 09-07-2005 19:35
C++ Help (Hooking a function) Peter[Pan] General Discussion 8 08-31-2004 20:37


All times are GMT +8. The time now is 09:33.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )