首页
社区
课程
招聘
[求助]小白发个求助帖!功力太弱,看不懂!!!
发表于: 2017-12-6 10:57 19752

[求助]小白发个求助帖!功力太弱,看不懂!!!

2017-12-6 10:57
19752
 

先感谢!!!
说明:这是从汇编翻译过来的,肯定有一些新手犯的错!多指教下!!!
代码:

#include <stdio.h>

typedef unsigned int ulong;
typedef unsigned short int uword;
typedef unsigned char ubyte;

ulong CalculateKey(ulong key)
{
    ubyte buf[16] = {0};
    ubyte constant[4] = {0x16, 0x75, 0xe4, 0x7f};
    ubyte *pConstant = constant;
    ubyte *pBuf0x7 = NULL;
    ubyte *pBuf0x3 = NULL;
    ubyte *pBuf0xb = NULL;
    ubyte *pBufFirst = NULL;
    ubyte *pBufLast = NULL;
    ubyte RH4 = 0, RL5 = 0, RL4 = 1;
    uword R2 = 0, R3 = 0, R4 = 0, R6 = 0;
    ulong R10R2 = 0, R2R4 = 0;

    /*
     *buf[4] = 0;
     *buf[5] = 0;
     *buf[6] = 0;
     *buf[7] = 0;
     */

    // 高字节存储在数组低位字节
    *(buf) = (ubyte)(key >> 24U);
    *(buf + 1) = (ubyte)(key >> 16U);
    *(buf + 2) = (ubyte)(key >> 8U);
    *(buf + 3) = (ubyte)(key);

    // 指针赋值
    pBuf0x7 = buf + 0x7;
    pBufLast = buf + 0x0f;
    pBuf0x3 = buf + 0x3;
    pBufFirst = buf + 0;
    pBuf0xb = buf + 0xb;

    R3 = 0x4;

    do
    {
        //R2 = pBuf0x3;
        RH4 = *pConstant; // 0x16, 0x75, 0xe4, 0x7f
        RH4 ^= *pBuf0x3;
        pBuf0x3 -= 1;
        *pBufLast = RH4;

        RL5 = 0x80;
        RL4 = 0x01;
        R6 = 0;

        // 将*pBufFirst位倒序写到*pBuf0x7
        do
        {
            if(RL5 & *pBufFirst)
            {
                *pBuf0x7 |= RL4;
            }

            RL5 = RL5 >> 1;
            RL4 += RL4;
        }while(R6++ < 7);

        *pBuf0x7 ^= *pConstant;
        pConstant++;

        RL5 = 0x04 - R3;
        RL5 <<= 3;

        //RH4 = *pBufLast;
        //R10R2 = RH4;
        //R4 = RH4 = *pBuf0x7;
        R10R2 = *pBuf0x7 + *pBufLast;

        R4 = RL5;

        if(R4 != 0)
        {
            if(R4 >= 0x10)
            {
                R4 -= 0x10;
                R10R2 <<= R4 + 16U;
            }
            else
            {
                R6 = (uword)R10R2;
                R10R2 <<= R4;
                R4 = 0x10 - R4;
                R6 = R6 >> R4;

                R10R2 |= (ulong)R6 << 16U;
            }
        }

        R2R4 += R10R2; // 其实是加上MAC累加器
        R2 = (uword)(R2R4 >> 16U);
        R4 = (uword)R2R4;
        pBufLast -= 1;
        pBuf0x7 -= 1;


        if(RL5 != 0 && RL5 >= 0x10)
        {
            RL5 -= 0x10;
            R4 = R2;
            R4 >>= RL5;
        }
        else
        {
            R4 = (R4 >> RL5) | (R2 >> (0x10 - RL5));
        }

        *pBuf0xb = R4 & 0xff;
        pBuf0xb -= 1;
        pBufFirst += 1;

    }while(R3-- >= 2); // 循环4次

    //R3 = MAH;
    //R2 = MAL;
    return R2R4;
}

int main(int argc, char **argv)
{
    ulong key = 0;

    printf("Input hex value: ");
    while (scanf("%x", &key)) {
        printf("key: 0x%x\n", CalculateKey(key));
        printf("Input hex value: ");
    }

    return 0;
}

[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)

收藏
免费 0
支持
分享
最新回复 (2)
雪    币: 140
活跃值: (94)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
2
这是哪个车型哪个模块的安全校验算法呢,很简单的呀,优化下就好了
2022-7-4 11:09
0
雪    币: 2552
活跃值: (4433)
能力值: ( LV3,RANK:20 )
在线值:
发帖
回帖
粉丝
3
没汇编咋看
2022-7-4 11:49
0
游客
登录 | 注册 方可回帖
返回
//