// *lhs=rhs
_QWORD *__fastcall dreflhs_rhs_withGC(_QWORD **pointer, void *mem_frommymalloc)
{
_QWORD *chunk_mem; // rax@2
_QWORD *chunk; // rax@4
_QWORD *result; // rax@5
if ( mem_frommymalloc )
{
chunk_mem = minus_16(mem_frommymalloc);
incre_ref(chunk_mem);
}
if ( *pointer )
{
chunk = minus_16(*pointer);
reduce_ref(chunk); // collapse
}
result = pointer;
*pointer = mem_frommymalloc;
return result;
}
__int64 __fastcall is_deref_a_inrange(_QWORD *a1)
{
return *a1 <= 0x7FFFFFFFEFFFLL && *a1 > 0x400000LL;
}
_DWORD *__fastcall ret_addr_of_first_addr(_QWORD *chunk, signed __int64 *pi)
{
signed __int64 i; // [sp+18h] [bp-18h]@3
signed __int64 size; // [sp+20h] [bp-10h]@3
_QWORD *mem; // [sp+28h] [bp-8h]@3
if ( !chunk )
exit(0);
mem = chunk + 2;
size = (chunk[1] - 16LL) / 8;
for ( i = *pi; i < size; ++i )
{
*pi = i;
if ( (unsigned __int8)is_deref_a_inrange(&mem[i]) )
return &mem[i];
}
return 0LL;
}
// also, reflect mem to chunk[2](data part)
_QWORD *__fastcall rec_chunk(_QWORD *chunk)
{
_QWORD *result; // rax@3
if ( !mem )
mem = malloc_adjust(4);
chunk[2] = mem;//任意chunk[2]可以被我们控制，会被赋值为mem的值，QWORD SHOOT here!!!
*mem = chunk; // 可能overflow，但我没用这个
result = mem + 1;
++mem;
return result;
}
__int64 __fastcall reduce_ref(_QWORD *chunk)
{
_QWORD *chunk_1; // rax@3
__int64 i; // [sp+10h] [bp-20h]@1
_QWORD *chunk_; // [sp+18h] [bp-18h]@1
_QWORD **p_elem; // [sp+20h] [bp-10h]@2
__int64 v6; // [sp+28h] [bp-8h]@1
v6 = *MK_FP(__FS__, 40LL);
i = 0LL;
chunk_ = chunk;
--*chunk;
if ( !*chunk_ ) // 如果引用计数变成0
{
while ( 1 )
{
p_elem = (_QWORD **)ret_addr_of_first_addr(chunk, &i);
if ( p_elem == 0LL ) // 如果在chunk中已经没有有效地址了
break;
++i; // 增加i并且做下次循环
chunk_1 = minus_16(*p_elem); // 如果 *pmem 是有效地址(在指定范围中)，但不一定是在mmap的堆中, 也会把它当作mmap中的chunk，进行rec_chunk的调用
rec_chunk(chunk_1); // 它被当成了chunk，但不一定是mmap中的chunk(0x41414141-16)
}
rec_chunk(chunk_);
}
return *MK_FP(__FS__, 40LL) ^ v6;
}
