[原创]X浪的S参数分析-Android安全-看雪安全社区｜专业技术交流与安全研究论坛

[原创]X浪的S参数分析

发表于: 2025-8-5 13:05 4998

[原创]X浪的S参数分析

易之生生

2025-8-5 13:05

4998

初始化操作
S参数的计算
10EA095010 为初始化参数，2015876998797为需要进行HASH的字符串。
Unidbg的运行日志如下:
主要的内容如下:
在0xe97c 处计算得出了5l0WXnhiY4pJ794KIJ7Rw5F45VXg9sjo 字符串
5l0WXnhiY4pJ794KIJ7Rw5F45VXg9sjo 是由内置的字符串OWA8W1RiZGVVOHxGOzU4R0VGO157OUo4OVpUazV 经过sub_34F40解密得出的
 
在0x3b48c 处引用了需要进行HASH的值 2015876998797
在0x3b48c 处引用了解密的值5l0WXnhiY4pJ794KIJ7Rw5F45VXg9sjo
在0x3b48c 处引用了初始化的值10EA095010
计算S参数的结果是a17486b9 在0xec2c 进行字符串生成的
 
对loc_EC1C进行分析，在0xEC1C下断点
 
0xe4fff631 存储的就是HASH后的结果
 
对0xe4fff631 - 0xe4fff638 下读写断点
 
在0xe780的地址进行了结果的赋值
 
Q0的值来自[SP,#0x180+var_E8] 地址为0xE4FFF618
 
 
对0xE4FFF618 - 0xE4FFF620下读写断点
 
生成结果的地址在0x8314 就是计算HASH的函数sub_75F0
函数比较长 0x8314 就是 memcpy(v26, s, v83);
 
然后查找v83的值生成处
 
V116和v117的值
 
以上还包含3个MD5个计算函数
 
计算流程如下：
3 次MD5 2次HASH512 再加一次计算得出结果 
public void nativeInit(){
 
    String M = "10EA095010";
    String N = "10EA095010";
    String O = "10EA095060";
 
    String nativeInit = "nativeInit(Ljava/lang/String;)V";
    SLib.callStaticJniMethod(emulator, nativeInit, M);
}
public void nativeInit(){
 
    String M = "10EA095010";
    String N = "10EA095010";
    String O = "10EA095060";
 
    String nativeInit = "nativeInit(Ljava/lang/String;)V";
    SLib.callStaticJniMethod(emulator, nativeInit, M);
}
public void nativeNewCalculateS(){
    Object custom = null;
    DvmObject context = vm.resolveClass("android/content/ContextWrapper").newObject(custom);
    System.out.println(context);
 
    String str = "2015876998797";
    int mode = 3;
    String nativeNewCalculateS = "nativeNewCalculateS(Landroid/content/Context;Ljava/lang/String;I)Ljava/lang/String;";
    Object obj = SLib.callStaticJniMethodObject(emulator, nativeNewCalculateS, context, str, mode);
    System.out.println(obj);
}
public void nativeNewCalculateS(){
    Object custom = null;
    DvmObject context = vm.resolveClass("android/content/ContextWrapper").newObject(custom);
    System.out.println(context);
 
    String str = "2015876998797";
    int mode = 3;
    String nativeNewCalculateS = "nativeNewCalculateS(Landroid/content/Context;Ljava/lang/String;I)Ljava/lang/String;";
    Object obj = SLib.callStaticJniMethodObject(emulator, nativeNewCalculateS, context, str, mode);
    System.out.println(obj);
}
1.  JNIEnv->FindClass(com/sina/weibo/security/SLib) was called from RWX@0x120026d4[libslib.so]0x26d4
2.  JNIEnv->RegisterNatives(com/sina/weibo/security/SLib, RWX@0x12050008[libslib.so]0x50008, 8) was called from RWX@0x1200259c[libslib.so]0x259c
3.  RegisterNative(com/sina/weibo/security/SLib, nativeInit(Ljava/lang/String;)V, RWX@0x120023b8[libslib.so]0x23b8)
4.  RegisterNative(com/sina/weibo/security/SLib, nativeNewCalculateS(Landroid/content/Context;Ljava/lang/String;I)Ljava/lang/String;, RWX@0x1200241c[libslib.so]0x241c)
5.  RegisterNative(com/sina/weibo/security/SLib, nativeGetV1TimeCost()J, RWX@0x12002080[libslib.so]0x2080)
6.  RegisterNative(com/sina/weibo/security/SLib, nativeGetV2TimeCost()J, RWX@0x12002150[libslib.so]0x2150)
7.  RegisterNative(com/sina/weibo/security/SLib, nativeCheck()Z, RWX@0x120022e4[libslib.so]0x22e4)
8.  RegisterNative(com/sina/weibo/security/SLib, nativeGetCheckErr()Ljava/lang/String;, RWX@0x12001e08[libslib.so]0x1e08)
9.  RegisterNative(com/sina/weibo/security/SLib, nativeGetCheckErrType()I, RWX@0x12001fb8[libslib.so]0x1fb8)
10. RegisterNative(com/sina/weibo/security/SLib, nativeGetPkgTimeCost()J, RWX@0x12002218[libslib.so]0x2218)
11. Find native function Java_com_sina_weibo_security_SLib_nativeInit => RWX@0x120023b8[libslib.so]0x23b8
12. JNIEnv->NewGlobalRef("10EA095010") was called from RWX@0x120023f0[libslib.so]0x23f0
13. android.content.ContextWrapper@50675690
14. Find native function Java_com_sina_weibo_security_SLib_nativeNewCalculateS => RWX@0x1200241c[libslib.so]0x241c
15. JNIEnv->FindClass(android/content/ContextWrapper) was called from RWX@0x120046a0[libslib.so]0x46a0
16. JNIEnv->GetMethodID(android/content/ContextWrapper.getPackageManager()Landroid/content/pm/PackageManager;) => 0x53f2c391 was called from RWX@0x12004440[libslib.so]0x4440
17. JNIEnv->FindClass(android/content/pm/PackageManager) was called from RWX@0x120047f8[libslib.so]0x47f8
18. JNIEnv->CallObjectMethodV(android.content.ContextWrapper@50675690, getPackageManager() => android.content.pm.PackageManager@47d384ee) was called from RWX@0x12004af8[libslib.so]0x4af8
19. JNIEnv->FindClass(android/content/pm/PackageInfo) was called from RWX@0x120049ec[libslib.so]0x49ec
20. JNIEnv->GetMethodID(android/content/pm/PackageManager.getPackageInfo(Ljava/lang/String;I)Landroid/content/pm/PackageInfo;) => 0x3bca8377 was called from RWX@0x12004700[libslib.so]0x4700
21. JNIEnv->GetMethodID(android/content/ContextWrapper.getPackageName()Ljava/lang/String;) => 0x8bcc2d71 was called from RWX@0x12004964[libslib.so]0x4964
22. JNIEnv->CallObjectMethodV(android.content.ContextWrapper@50675690, getPackageName() => "com.sina.weibo") was called from RWX@0x12004af8[libslib.so]0x4af8
23. JNIEnv->CallObjectMethodV(android.content.pm.PackageManager@47d384ee, getPackageInfo("com.sina.weibo", 0x40) => android.content.pm.PackageInfo@2acf57e3) was called from RWX@0x12004af8[libslib.so]0x4af8
24. JNIEnv->GetFieldID(android/content/pm/PackageInfo.signatures [Landroid/content/pm/Signature;) => 0x25f17218 was called from RWX@0x12004794[libslib.so]0x4794
25. JNIEnv->GetObjectField(android.content.pm.PackageInfo@2acf57e3, signatures [Landroid/content/pm/Signature; => [android.content.pm.Signature@36f6e879]) was called from RWX@0x12004618[libslib.so]0x4618
26. JNIEnv->FindClass(android/content/pm/Signature) was called from RWX@0x1200473c[libslib.so]0x473c
27. JNIEnv->GetMethodID(android/content/pm/Signature.toByteArray()[B) => 0x6a3e2031 was called from RWX@0x120045ac[libslib.so]0x45ac
28. JNIEnv->GetObjectArrayElement([android.content.pm.Signature@36f6e879], 0) => android.content.pm.Signature@36f6e879 was called from RWX@0x12004844[libslib.so]0x4844
29. JNIEnv->CallObjectMethodV(android.content.pm.Signature@36f6e879, toByteArray() => [B@3551a94) was called from RWX@0x12004af8[libslib.so]0x4af8
30. JNIEnv->GetByteArrayElements(false) => [B@3551a94 was called from RWX@0x12003f74[libslib.so]0x3f74
31. JNIEnv->NewStringUTF("5l0WXnhiY4pJ794KIJ7Rw5F45VXg9sjo") was called from RWX@0x1200e97c[libslib.so]0xe97c
32. JNIEnv->NewGlobalRef("5l0WXnhiY4pJ794KIJ7Rw5F45VXg9sjo") was called from RWX@0x1200e9a4[libslib.so]0xe9a4
33. JNIEnv->GetStringUtfChars("2015876998797") was called from RWX@0x1203b48c[libslib.so]0x3b48c
34. JNIEnv->ReleaseStringUTFChars("2015876998797") was called from RWX@0x1203b390[libslib.so]0x3b390
35. JNIEnv->GetStringUtfChars("5l0WXnhiY4pJ794KIJ7Rw5F45VXg9sjo") was called from RWX@0x1203b48c[libslib.so]0x3b48c
36. JNIEnv->ReleaseStringUTFChars("5l0WXnhiY4pJ794KIJ7Rw5F45VXg9sjo") was called from RWX@0x1203b390[libslib.so]0x3b390
37. JNIEnv->GetStringUtfChars("10EA095010") was called from RWX@0x1203b48c[libslib.so]0x3b48c
38. JNIEnv->ReleaseStringUTFChars("10EA095010") was called from RWX@0x1203b390[libslib.so]0x3b390
39. JNIEnv->NewStringUTF("a17486b9") was called from RWX@0x1200ec2c[libslib.so]0xec2c
40. "a17486b9"
1.  JNIEnv->FindClass(com/sina/weibo/security/SLib) was called from RWX@0x120026d4[libslib.so]0x26d4
2.  JNIEnv->RegisterNatives(com/sina/weibo/security/SLib, RWX@0x12050008[libslib.so]0x50008, 8) was called from RWX@0x1200259c[libslib.so]0x259c
3.  RegisterNative(com/sina/weibo/security/SLib, nativeInit(Ljava/lang/String;)V, RWX@0x120023b8[libslib.so]0x23b8)
4.  RegisterNative(com/sina/weibo/security/SLib, nativeNewCalculateS(Landroid/content/Context;Ljava/lang/String;I)Ljava/lang/String;, RWX@0x1200241c[libslib.so]0x241c)
5.  RegisterNative(com/sina/weibo/security/SLib, nativeGetV1TimeCost()J, RWX@0x12002080[libslib.so]0x2080)
6.  RegisterNative(com/sina/weibo/security/SLib, nativeGetV2TimeCost()J, RWX@0x12002150[libslib.so]0x2150)
7.  RegisterNative(com/sina/weibo/security/SLib, nativeCheck()Z, RWX@0x120022e4[libslib.so]0x22e4)
8.  RegisterNative(com/sina/weibo/security/SLib, nativeGetCheckErr()Ljava/lang/String;, RWX@0x12001e08[libslib.so]0x1e08)
9.  RegisterNative(com/sina/weibo/security/SLib, nativeGetCheckErrType()I, RWX@0x12001fb8[libslib.so]0x1fb8)
10. RegisterNative(com/sina/weibo/security/SLib, nativeGetPkgTimeCost()J, RWX@0x12002218[libslib.so]0x2218)
11. Find native function Java_com_sina_weibo_security_SLib_nativeInit => RWX@0x120023b8[libslib.so]0x23b8
12. JNIEnv->NewGlobalRef("10EA095010") was called from RWX@0x120023f0[libslib.so]0x23f0
13. android.content.ContextWrapper@50675690
14. Find native function Java_com_sina_weibo_security_SLib_nativeNewCalculateS => RWX@0x1200241c[libslib.so]0x241c
15. JNIEnv->FindClass(android/content/ContextWrapper) was called from RWX@0x120046a0[libslib.so]0x46a0
16. JNIEnv->GetMethodID(android/content/ContextWrapper.getPackageManager()Landroid/content/pm/PackageManager;) => 0x53f2c391 was called from RWX@0x12004440[libslib.so]0x4440
17. JNIEnv->FindClass(android/content/pm/PackageManager) was called from RWX@0x120047f8[libslib.so]0x47f8
18. JNIEnv->CallObjectMethodV(android.content.ContextWrapper@50675690, getPackageManager() => android.content.pm.PackageManager@47d384ee) was called from RWX@0x12004af8[libslib.so]0x4af8
19. JNIEnv->FindClass(android/content/pm/PackageInfo) was called from RWX@0x120049ec[libslib.so]0x49ec
20. JNIEnv->GetMethodID(android/content/pm/PackageManager.getPackageInfo(Ljava/lang/String;I)Landroid/content/pm/PackageInfo;) => 0x3bca8377 was called from RWX@0x12004700[libslib.so]0x4700
21. JNIEnv->GetMethodID(android/content/ContextWrapper.getPackageName()Ljava/lang/String;) => 0x8bcc2d71 was called from RWX@0x12004964[libslib.so]0x4964
22. JNIEnv->CallObjectMethodV(android.content.ContextWrapper@50675690, getPackageName() => "com.sina.weibo") was called from RWX@0x12004af8[libslib.so]0x4af8
23. JNIEnv->CallObjectMethodV(android.content.pm.PackageManager@47d384ee, getPackageInfo("com.sina.weibo", 0x40) => android.content.pm.PackageInfo@2acf57e3) was called from RWX@0x12004af8[libslib.so]0x4af8
24. JNIEnv->GetFieldID(android/content/pm/PackageInfo.signatures [Landroid/content/pm/Signature;) => 0x25f17218 was called from RWX@0x12004794[libslib.so]0x4794
25. JNIEnv->GetObjectField(android.content.pm.PackageInfo@2acf57e3, signatures [Landroid/content/pm/Signature; => [android.content.pm.Signature@36f6e879]) was called from RWX@0x12004618[libslib.so]0x4618
26. JNIEnv->FindClass(android/content/pm/Signature) was called from RWX@0x1200473c[libslib.so]0x473c
27. JNIEnv->GetMethodID(android/content/pm/Signature.toByteArray()[B) => 0x6a3e2031 was called from RWX@0x120045ac[libslib.so]0x45ac
28. JNIEnv->GetObjectArrayElement([android.content.pm.Signature@36f6e879], 0) => android.content.pm.Signature@36f6e879 was called from RWX@0x12004844[libslib.so]0x4844
29. JNIEnv->CallObjectMethodV(android.content.pm.Signature@36f6e879, toByteArray() => [B@3551a94) was called from RWX@0x12004af8[libslib.so]0x4af8
30. JNIEnv->GetByteArrayElements(false) => [B@3551a94 was called from RWX@0x12003f74[libslib.so]0x3f74
31. JNIEnv->NewStringUTF("5l0WXnhiY4pJ794KIJ7Rw5F45VXg9sjo") was called from RWX@0x1200e97c[libslib.so]0xe97c
32. JNIEnv->NewGlobalRef("5l0WXnhiY4pJ794KIJ7Rw5F45VXg9sjo") was called from RWX@0x1200e9a4[libslib.so]0xe9a4
33. JNIEnv->GetStringUtfChars("2015876998797") was called from RWX@0x1203b48c[libslib.so]0x3b48c
34. JNIEnv->ReleaseStringUTFChars("2015876998797") was called from RWX@0x1203b390[libslib.so]0x3b390
35. JNIEnv->GetStringUtfChars("5l0WXnhiY4pJ794KIJ7Rw5F45VXg9sjo") was called from RWX@0x1203b48c[libslib.so]0x3b48c
36. JNIEnv->ReleaseStringUTFChars("5l0WXnhiY4pJ794KIJ7Rw5F45VXg9sjo") was called from RWX@0x1203b390[libslib.so]0x3b390
37. JNIEnv->GetStringUtfChars("10EA095010") was called from RWX@0x1203b48c[libslib.so]0x3b48c
38. JNIEnv->ReleaseStringUTFChars("10EA095010") was called from RWX@0x1203b390[libslib.so]0x3b390
39. JNIEnv->NewStringUTF("a17486b9") was called from RWX@0x1200ec2c[libslib.so]0xec2c
40. "a17486b9"
1.  JNIEnv->NewStringUTF("5l0WXnhiY4pJ794KIJ7Rw5F45VXg9sjo") was called from RWX@0x1200e97c[libslib.so]0xe97c
2.  JNIEnv->NewGlobalRef("5l0WXnhiY4pJ794KIJ7Rw5F45VXg9sjo") was called from RWX@0x1200e9a4[libslib.so]0xe9a4
3.  JNIEnv->GetStringUtfChars("2015876998797") was called from RWX@0x1203b48c[libslib.so]0x3b48c
4.  JNIEnv->ReleaseStringUTFChars("2015876998797") was called from RWX@0x1203b390[libslib.so]0x3b390
5.  JNIEnv->GetStringUtfChars("5l0WXnhiY4pJ794KIJ7Rw5F45VXg9sjo") was called from RWX@0x1203b48c[libslib.so]0x3b48c
6.  JNIEnv->ReleaseStringUTFChars("5l0WXnhiY4pJ794KIJ7Rw5F45VXg9sjo") was called from RWX@0x1203b390[libslib.so]0x3b390
7.  JNIEnv->GetStringUtfChars("10EA095010") was called from RWX@0x1203b48c[libslib.so]0x3b48c
8.  JNIEnv->ReleaseStringUTFChars("10EA095010") was called from RWX@0x1203b390[libslib.so]0x3b390
9.  JNIEnv->NewStringUTF("a17486b9") was called from RWX@0x1200ec2c[libslib.so]0xec2c
10. "a17486b9"
1.  JNIEnv->NewStringUTF("5l0WXnhiY4pJ794KIJ7Rw5F45VXg9sjo") was called from RWX@0x1200e97c[libslib.so]0xe97c
2.  JNIEnv->NewGlobalRef("5l0WXnhiY4pJ794KIJ7Rw5F45VXg9sjo") was called from RWX@0x1200e9a4[libslib.so]0xe9a4
3.  JNIEnv->GetStringUtfChars("2015876998797") was called from RWX@0x1203b48c[libslib.so]0x3b48c
4.  JNIEnv->ReleaseStringUTFChars("2015876998797") was called from RWX@0x1203b390[libslib.so]0x3b390
5.  JNIEnv->GetStringUtfChars("5l0WXnhiY4pJ794KIJ7Rw5F45VXg9sjo") was called from RWX@0x1203b48c[libslib.so]0x3b48c
6.  JNIEnv->ReleaseStringUTFChars("5l0WXnhiY4pJ794KIJ7Rw5F45VXg9sjo") was called from RWX@0x1203b390[libslib.so]0x3b390
7.  JNIEnv->GetStringUtfChars("10EA095010") was called from RWX@0x1203b48c[libslib.so]0x3b48c
8.  JNIEnv->ReleaseStringUTFChars("10EA095010") was called from RWX@0x1203b390[libslib.so]0x3b390
9.  JNIEnv->NewStringUTF("a17486b9") was called from RWX@0x1200ec2c[libslib.so]0xec2c
10. "a17486b9"
public void write_trace(){
    emulator.traceRead(0xe4fff631L, 0xe4fff638L);
    emulator.traceWrite(0xe4fff631L, 0xe4fff638L);
}
public void write_trace(){
    emulator.traceRead(0xe4fff631L, 0xe4fff638L);
    emulator.traceWrite(0xe4fff631L, 0xe4fff638L);
}
LDR             X9, [SP,#0x180+var_D8]
LDUR            Q0, [SP,#0x180+var_E8]
MOV             W8, WZR
STR             X9, [X28,#0x10]
ADD             X9, SP, #0x180+var_E8
STR             Q0, [X28] ; 0x396236383437316110
LDR             X9, [SP,#0x180+var_D8]
LDUR            Q0, [SP,#0x180+var_E8]
MOV             W8, WZR
STR             X9, [X28,#0x10]
ADD             X9, SP, #0x180+var_E8
STR             Q0, [X28] ; 0x396236383437316110
public void write_trace(){
    emulator.traceRead(0xe4fff631L, 0xe4fff638L);
    emulator.traceWrite(0xe4fff631L, 0xe4fff638L);
 
    emulator.traceRead(0xe4fff618L, 0xe4fff620L);
    emulator.traceWrite(0xe4fff618L, 0xe4fff620L);
}
public void write_trace(){
    emulator.traceRead(0xe4fff631L, 0xe4fff638L);
    emulator.traceWrite(0xe4fff631L, 0xe4fff638L);
 
    emulator.traceRead(0xe4fff618L, 0xe4fff620L);
    emulator.traceWrite(0xe4fff618L, 0xe4fff620L);
}
void __usercall sub_75F0(__int64 a1@<X0>, const char *a2@<X1>, __int64 a3@<X2>, __int64 *a4@<X8>)
{
  const char *v5; // x9
  const char *v7; // x20
  int v8; // w23
  const char *v9; // x8
  int v10; // w10
  int v11; // w12
  int v12; // w13
  const char *v13; // x22
  bool v14; // zf
  int v15; // w16
  const char *v16; // x0
  int v17; // w15
  size_t v18; // x0
  _QWORD *v19; // x8
  _QWORD *v20; // x0
  const char *v21; // x1
  _QWORD *v22; // x9
  _QWORD *v23; // x8
  int v24; // w10
  int v25; // w16
  void *v26; // x21
  int v27; // w15
  int v28; // w16
  const char *v29; // x0
  int v30; // w15
  size_t v31; // x0
  _QWORD *v32; // x8
  _QWORD *v33; // x0
  const char *v34; // x1
  _QWORD *v35; // x9
  _QWORD *v36; // x8
  int v37; // w10
  int v38; // w16
  _QWORD *v39; // x20
  int v40; // w15
  int v41; // w16
  const char *v42; // x0
  int v43; // w15
  size_t v44; // x0
  _QWORD *v45; // x8
  __int64 *v46; // x0
  size_t v47; // x2
  int v48; // w16
  int v49; // w18
  __int64 *v50; // x1
  int v51; // w17
  int v52; // w12
  int v53; // w15
  int v54; // w16
  __int64 v55; // x0
  __int128 v56; // q0
  unsigned int v57; // w12
  int v58; // w13
  int v59; // w8
  char *v60; // x0
  const char *v61; // x1
  int v62; // w10
  int v63; // w16
  char *v64; // x20
  int v65; // w15
  int v66; // w16
  const char *v67; // x0
  int v68; // w15
  size_t v69; // x0
  char *v70; // x0
  const char *v71; // x1
  int v72; // w10
  int v73; // w16
  char *v74; // x20
  int v75; // w15
  const char *v76; // x0
  int v77; // w15
  size_t v78; // x0
  int v79; // w15
  int v80; // w14
  int v81; // w16
  size_t v82; // x0
  size_t v83; // x20
  __int64 v84; // x10
  unsigned __int64 v85; // x26
  int v86; // w27
  int v87; // w22
  int v88; // w8
  unsigned __int64 v89; // x10
  int v90; // w8
  int v91; // w11
  int v92; // w9
  __int64 v93; // x8
  int v94; // w23
  int i; // w9
  int v96; // w8
  int v97; // w8
  int v98; // w8
  int v99; // w8
  int v100; // w8
  int v101; // w8
  unsigned __int64 v102; // [xsp+10h] [xbp-2B0h]
  char v103; // [xsp+20h] [xbp-2A0h]
  int v104; // [xsp+24h] [xbp-29Ch]
  __int64 v105[2]; // [xsp+78h] [xbp-248h] BYREF
  void *v106; // [xsp+88h] [xbp-238h]
  __int128 v107; // [xsp+90h] [xbp-230h] BYREF
  void *v108; // [xsp+A0h] [xbp-220h]
  void *src[3]; // [xsp+B0h] [xbp-210h] BYREF
  void *v110[3]; // [xsp+C8h] [xbp-1F8h] BYREF
  size_t v111[2]; // [xsp+E0h] [xbp-1E0h] BYREF
  void *v112; // [xsp+F0h] [xbp-1D0h]
  unsigned __int64 v113; // [xsp+F8h] [xbp-1C8h]
  unsigned int v114; // [xsp+100h] [xbp-1C0h]
  char s[12]; // [xsp+104h] [xbp-1BCh] BYREF
  _BYTE v116[132]; // [xsp+110h] [xbp-1B0h] BYREF
  _BYTE v117[132]; // [xsp+194h] [xbp-12Ch] BYREF
  __int64 v118; // [xsp+218h] [xbp-A8h] BYREF
  __int64 v119; // [xsp+220h] [xbp-A0h]
  __int64 v120[9]; // [xsp+228h] [xbp-98h] BYREF
 
  v120[8] = *(_QWORD *)(_ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2)) + 40);
  v5 = *(const char **)(a1 + 16);
  v7 = a2;
  v8 = -474758095;
  v9 = (const char *)(a1 + 1);
  if ( ((*(_BYTE *)a1 ^ 0xFE) & *(_BYTE *)a1) != 0 )
    v10 = 1056576168;
  else
    v10 = 529704559;
  v11 = -474758095;
  do
  {
    while ( 1 )
    {
      v12 = v11;
      v13 = a2;
      v11 = 1499283521;
      while ( v12 <= 529704558 )
      {
        v14 = v12 == -474758095;
        v12 = v10;
        if ( !v14 )
        {
          while ( 1 )
            ;
        }
      }
      if ( v12 != 529704559 )
        break;
      a2 = (const char *)(a1 + 1);
    }
    a2 = *(const char **)(a1 + 16);
  }
  while ( v12 == 1056576168 );
  v15 = -474758095;
  do
  {
    while ( 1 )
    {
      v16 = a2;
      v17 = v15;
      while ( v17 <= 529704558 )
      {
        v14 = v17 == -474758095;
        v17 = v10;
        if ( !v14 )
        {
          while ( 1 )
            ;
        }
      }
      if ( v17 != 529704559 )
        break;
      a2 = v9;
      v15 = 1499283521;
    }
    a2 = v5;
    v15 = 1499283521;
  }
  while ( v17 == 1056576168 );
  v18 = strlen(v16);
  sub_32C14(v19, v13, v18, &v118);              // MD5
  v20 = sub_8620(v111, &v118, 16LL);
  v118 = 0LL;
  v119 = 0LL;
  v22 = *(_QWORD **)(a3 + 16);
  v23 = (_QWORD *)(a3 + 1);
  if ( (~*(_BYTE *)a3 | 0xFFFFFFFE) == 0xFFFFFFFF )
    v24 = 529704559;
  else
    v24 = 1056576168;
  v25 = -474758095;
  do
  {
    while ( 1 )
    {
      v26 = v20;
      v27 = v25;
      while ( v27 <= 529704558 )
      {
        v14 = v27 == -474758095;
        v27 = v24;
        if ( !v14 )
        {
          while ( 1 )
            ;
        }
      }
      if ( v27 != 529704559 )
        break;
      v20 = v23;
      v25 = 1499283521;
    }
    v20 = v22;
    v25 = 1499283521;
  }
  while ( v27 == 1056576168 );
  v28 = -474758095;
  do
  {
    while ( 1 )
    {
      v29 = v21;
      v30 = v28;
      while ( v30 <= 529704558 )
      {
        v14 = v30 == -474758095;
        v30 = v24;
        if ( !v14 )
        {
          while ( 1 )
            ;
        }
      }
      if ( v30 != 529704559 )
        break;
      v21 = (const char *)v23;
      v28 = 1499283521;
    }
    v21 = (const char *)v22;
    v28 = 1499283521;
  }
  while ( v30 == 1056576168 );
  v31 = strlen(v29);
  sub_32C14(v32, v26, v31, &v118);              // MD5
  v33 = sub_8620(v110, &v118, 16LL);
  v118 = 0LL;
  v119 = 0LL;
  v35 = (_QWORD *)*((_QWORD *)v7 + 2);
  v36 = v7 + 1;
  if ( ((*v7 ^ 0xFE) & *v7) != 0 )
    v37 = 1056576168;
  else
    v37 = 529704559;
  v38 = -474758095;
  do
  {
    while ( 1 )
    {
      v39 = v33;
      v40 = v38;
      while ( v40 <= 529704558 )
      {
        v14 = v40 == -474758095;
        v40 = v37;
        if ( !v14 )
        {
          while ( 1 )
            ;
        }
      }
      if ( v40 != 529704559 )
        break;
      v33 = v36;
      v38 = 1499283521;
    }
    v33 = v35;
    v38 = 1499283521;
  }
  while ( v40 == 1056576168 );
  v41 = -474758095;
  do
  {
    while ( 1 )
    {
      v42 = v34;
      v43 = v41;
      while ( v43 <= 529704558 )
      {
        v14 = v43 == -474758095;
        v43 = v37;
        if ( !v14 )
        {
          while ( 1 )
            ;
        }
      }
      if ( v43 != 529704559 )
        break;
      v34 = (const char *)v36;
      v41 = 1499283521;
    }
    v34 = (const char *)v35;
    v41 = 1499283521;
  }
  while ( v43 == 1056576168 );
  v44 = strlen(v42);
  sub_32C14(v45, v39, v44, &v118);              // MD5
  sub_8620(src, &v118, 16LL);
  v46 = sub_6F20(v120, src);
  if ( (~LOBYTE(v111[0]) | 0xFFFFFFFE) == 0xFFFFFFFF )
    v48 = 529704559;
  else
    v48 = 1056576168;
  v49 = -474758095;
  do
  {
    while ( 1 )
    {
      v50 = v46;
      v51 = v49;
      while ( v51 <= 529704558 )
      {
        v14 = v51 == -474758095;
        v51 = v48;
        if ( !v14 )
        {
          while ( 1 )
            ;
        }
      }
      if ( v51 != 529704559 )
        break;
      v46 = (__int64 *)((char *)v111 + 1);
      v49 = 1499283521;
    }
    v46 = (__int64 *)v112;
    v49 = 1499283521;
  }
  while ( v51 == 1056576168 );
  if ( (v111[0] & 1) != 0 )
    v52 = 1552367478;
  else
    v52 = 132625284;
  v53 = -1135239934;
  do
  {
    while ( 1 )
    {
      v54 = v53;
      if ( v53 <= 132625283 )
        break;
      if ( v53 == 132625284 )
      {
        v53 = -1840677486;
        v47 = (unsigned __int64)LOBYTE(v111[0]) >> 1;
      }
      else
      {
        v53 = -1840677486;
        v47 = v111[1];
      }
    }
    v53 = v52;
  }
  while ( v54 == -1135239934 );
  if ( v54 != -1840677486 )
  {
    while ( 1 )
      ;
  }
  v55 = sub_9538((int)v120, v50, v47);
  v108 = *(void **)(v55 + 16);
  v56 = *(_OWORD *)v55;
  v57 = 0;
  v113 = v55;
  v107 = v56;
  while ( 1 )
  {
    v114 = v57;
    v58 = v57 >= 3 ? -1129254591 : 1805009445;
    if ( v58 == -1129254591 )
      break;
    *(_QWORD *)(v113 + 8LL * v114) = 0LL;
    v57 = v114 + 1;
  }
  if ( ((LOBYTE(v120[0]) ^ 0xFE) & v120[0]) != 0 )
    v59 = 1202870824;
  else
    v59 = -946146110;
  while ( v59 == 1202870824 )
  {
    operator delete((void *)v120[2]);
    v59 = -946146110;
  }
  v60 = (char *)memset(v117, 0, 0x81uLL);
  if ( (~(_BYTE)v107 | 0xFFFFFFFE) == 0xFFFFFFFF )
    v62 = 529704559;
  else
    v62 = 1056576168;
  v63 = -474758095;
  do
  {
    while ( 1 )
    {
      v64 = v60;
      v65 = v63;
      while ( v65 <= 529704558 )
      {
        v14 = v65 == -474758095;
        v65 = v62;
        if ( !v14 )
        {
          while ( 1 )
            ;
        }
      }
      if ( v65 != 529704559 )
        break;
      v60 = (char *)&v107 + 1;
      v63 = 1499283521;
    }
    v60 = (char *)v108;
    v63 = 1499283521;
  }
  while ( v65 == 1056576168 );
  v66 = -474758095;
  do
  {
    while ( 1 )
    {
      v67 = v61;
      v68 = v66;
      while ( v68 <= 529704558 )
      {
        v14 = v68 == -474758095;
        v68 = v62;
        if ( !v14 )
        {
          while ( 1 )
            ;
        }
      }
      if ( v68 != 529704559 )
        break;
      v61 = (char *)&v107 + 1;
      v66 = 1499283521;
    }
    v61 = (const char *)v108;
    v66 = 1499283521;
  }
  while ( v68 == 1056576168 );
  v69 = strlen(v67);
  sub_DA48(v64, v69, v120, 0LL);                // SHA512
  sub_A460(v120, v117, 64LL);                   // HEX2STR
  sub_6F20(v105, v110);
  v70 = (char *)memset(v116, 0, 0x81uLL);
  if ( (~LOBYTE(v105[0]) | 0xFFFFFFFE) == 0xFFFFFFFF )
    v72 = 529704559;
  else
    v72 = 1056576168;
  v73 = -474758095;
  do
  {
    while ( 1 )
    {
      v74 = v70;
      v75 = v73;
      while ( v75 <= 529704558 )
      {
        v14 = v75 == -474758095;
        v75 = v72;
        if ( !v14 )
        {
          while ( 1 )
            ;
        }
      }
      if ( v75 != 529704559 )
        break;
      v70 = (char *)v105 + 1;
      v73 = 1499283521;
    }
    v70 = (char *)v106;
    v73 = 1499283521;
  }
  while ( v75 == 1056576168 );
  do
  {
    while ( 1 )
    {
      v76 = v71;
      v77 = v8;
      while ( v77 <= 529704558 )
      {
        v14 = v77 == -474758095;
        v77 = v72;
        if ( !v14 )
        {
          while ( 1 )
            ;
        }
      }
      if ( v77 != 529704559 )
        break;
      v71 = (char *)v105 + 1;
      v8 = 1499283521;
    }
    v71 = (const char *)v106;
    v8 = 1499283521;
  }
  while ( v77 == 1056576168 );
  v104 = -1466222360;
  v78 = strlen(v76);
  sub_DA48(v74, v78, v120, 0LL);                // SHA512
  sub_A460(v120, v116, 64LL);                   // HEX2STR
  s[8] = 0;
  *(_QWORD *)s = 0LL;
  v79 = 0;
  v80 = 0;
  while ( 1 )
  {
    v81 = v79 >= 8 ? 1072340417 : 1158358064;
    if ( v81 == 1072340417 )
      break;
    v80 = v116[15 * v79 + v80] & 0xF;
    s[v79] = v117[v80 - -15 * v79];
    ++v79;
  }
  a4[1] = 0LL;
  a4[2] = 0LL;
  *a4 = 0LL;
  v82 = strlen(s);                              // s 最终结果 a17486b9
  v83 = v82;
  v103 = 2 * v82;
  v113 = -17LL;
  v84 = 0x75D037FEF5196874LL;
  v85 = ((v82 + 16) & 0xFFFFFFFFFFFFFFF0LL) - 1;
  if ( v82 >= 0x17 )
    v86 = -1265047312;
  else
    v86 = 532294316;
  if ( v82 >= 0x17 )
    v87 = -1136773100;
  else
    v87 = 542793441;
  v88 = 1557339140;
  while ( 1 )
  {
    while ( 1 )
    {
      while ( v88 > 532294315 )
      {
        if ( v88 == 532294316 )
        {
          v26 = (char *)a4 + 1;
          *(_BYTE *)a4 = v103;
          v88 = 289241049;
        }
        else
        {
          if ( v88 != 1557339140 )
            abort();
          if ( v113 >= v83 )
            v88 = 485505648;
          else
            v88 = 1132855204;
        }
      }
      if ( v88 != -1265047312 )
        break;
      v91 = 1244402348;
      do
      {
        do
        {
          v92 = v91;
          v93 = v84;
          v84 = v85;
          v91 = 542793441;
        }
        while ( v92 == -1136773100 );
        v84 = 22LL;
        v91 = v87;
      }
      while ( v92 == 1244402348 );
      v120[0] = -1LL;
      v89 = v93 + 1;
      v90 = -1981771486;
      while ( v90 == -1981771486 )
      {
        if ( v120[0] >= v89 )
          v90 = 1316265428;
        else
          v90 = 1353982062;
      }
      if ( v90 != 1316265428 )
        abort();
      v102 = v89;
      v26 = (void *)operator new(v89);
      a4[2] = (__int64)v26;
      *a4 = v102 & 1 | v102 ^ 1;
      a4[1] = v83;
      v88 = 289241049;
    }
    if ( v88 == 289241049 )
      break;
    v14 = v88 == 485505648;
    v88 = v86;
    if ( !v14 )
    {
      while ( 1 )
        ;
    }
  }
  if ( v83 )
    v94 = 1317118332;
  else
    v94 = -1355603513;
  for ( i = -2002632165; ; i = -1355603513 )
  {
    do
    {
      v96 = i;
      v14 = i == -2002632165;
      i = v94;
    }
    while ( v14 );
    if ( v96 != 1317118332 )
      break;
    memcpy(v26, s, v83);                        // v26 s 最终结果 a17486b9
  }
  if ( v96 != -1355603513 )
  {
    while ( 1 )
      ;
  }
  *((_BYTE *)v26 + v83) = 0;
  if ( ((LOBYTE(v105[0]) ^ 0xFE) & v105[0]) != 0 )
    v97 = 1202870824;
  else
    v97 = -946146110;
  while ( v97 == 1202870824 )
  {
    operator delete(v106);
    v97 = -946146110;
  }
  if ( (~(_BYTE)v107 | 0xFFFFFFFE) == 0xFFFFFFFF )
    v98 = -946146110;
  else
    v98 = 1202870824;
  while ( v98 == 1202870824 )
  {
    operator delete(v108);
    v98 = -946146110;
  }
  if ( ((LOBYTE(src[0]) ^ 0xFE) & (__int64)src[0]) != 0 )
    v99 = 1202870824;
  else
    v99 = -946146110;
  while ( v99 == 1202870824 )
  {
    operator delete(src[2]);
    v99 = -946146110;
  }
  if ( (~LOBYTE(v110[0]) | 0xFFFFFFFE) == 0xFFFFFFFF )
    v100 = -946146110;
  else
    v100 = 1202870824;
  while ( v100 == 1202870824 )
  {
    operator delete(v110[2]);
    v100 = -946146110;
  }
  while ( 1 )
  {
    while ( v104 == -1466222360 )
    {
      if ( (~LOBYTE(v111[0]) | 0xFFFFFFFE) == 0xFFFFFFFF )
        v101 = -946146110;
      else
        v101 = 1202870824;
      v104 = v101;
    }
    if ( v104 != 1202870824 )
      break;
    operator delete(v112);
    v104 = -946146110;
  }
  _ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2));
}
void __usercall sub_75F0(__int64 a1@<X0>, const char *a2@<X1>, __int64 a3@<X2>, __int64 *a4@<X8>)
{
  const char *v5; // x9
  const char *v7; // x20
  int v8; // w23
  const char *v9; // x8
  int v10; // w10
  int v11; // w12
  int v12; // w13
  const char *v13; // x22
  bool v14; // zf
  int v15; // w16
  const char *v16; // x0
  int v17; // w15
  size_t v18; // x0
  _QWORD *v19; // x8
  _QWORD *v20; // x0
  const char *v21; // x1
  _QWORD *v22; // x9
  _QWORD *v23; // x8
  int v24; // w10
  int v25; // w16
  void *v26; // x21
  int v27; // w15
  int v28; // w16
  const char *v29; // x0
  int v30; // w15
  size_t v31; // x0
  _QWORD *v32; // x8
  _QWORD *v33; // x0
  const char *v34; // x1
  _QWORD *v35; // x9
  _QWORD *v36; // x8
  int v37; // w10
  int v38; // w16
  _QWORD *v39; // x20
  int v40; // w15
  int v41; // w16
  const char *v42; // x0
  int v43; // w15
  size_t v44; // x0
  _QWORD *v45; // x8
  __int64 *v46; // x0
  size_t v47; // x2
  int v48; // w16
  int v49; // w18
  __int64 *v50; // x1
  int v51; // w17
  int v52; // w12
  int v53; // w15
  int v54; // w16
  __int64 v55; // x0
  __int128 v56; // q0
  unsigned int v57; // w12
  int v58; // w13
  int v59; // w8
  char *v60; // x0
  const char *v61; // x1
  int v62; // w10
  int v63; // w16
  char *v64; // x20
  int v65; // w15
  int v66; // w16
  const char *v67; // x0
  int v68; // w15
  size_t v69; // x0
  char *v70; // x0
  const char *v71; // x1
  int v72; // w10
  int v73; // w16
  char *v74; // x20
  int v75; // w15
  const char *v76; // x0
  int v77; // w15
  size_t v78; // x0
  int v79; // w15
  int v80; // w14
  int v81; // w16
  size_t v82; // x0
  size_t v83; // x20
  __int64 v84; // x10
  unsigned __int64 v85; // x26
  int v86; // w27
  int v87; // w22
  int v88; // w8
  unsigned __int64 v89; // x10
  int v90; // w8
  int v91; // w11
  int v92; // w9
  __int64 v93; // x8
  int v94; // w23
  int i; // w9
  int v96; // w8
  int v97; // w8
  int v98; // w8
  int v99; // w8
  int v100; // w8
  int v101; // w8
  unsigned __int64 v102; // [xsp+10h] [xbp-2B0h]
  char v103; // [xsp+20h] [xbp-2A0h]
  int v104; // [xsp+24h] [xbp-29Ch]
  __int64 v105[2]; // [xsp+78h] [xbp-248h] BYREF
  void *v106; // [xsp+88h] [xbp-238h]
  __int128 v107; // [xsp+90h] [xbp-230h] BYREF
  void *v108; // [xsp+A0h] [xbp-220h]
  void *src[3]; // [xsp+B0h] [xbp-210h] BYREF
  void *v110[3]; // [xsp+C8h] [xbp-1F8h] BYREF
  size_t v111[2]; // [xsp+E0h] [xbp-1E0h] BYREF
  void *v112; // [xsp+F0h] [xbp-1D0h]
  unsigned __int64 v113; // [xsp+F8h] [xbp-1C8h]
  unsigned int v114; // [xsp+100h] [xbp-1C0h]
  char s[12]; // [xsp+104h] [xbp-1BCh] BYREF
  _BYTE v116[132]; // [xsp+110h] [xbp-1B0h] BYREF
  _BYTE v117[132]; // [xsp+194h] [xbp-12Ch] BYREF
  __int64 v118; // [xsp+218h] [xbp-A8h] BYREF
  __int64 v119; // [xsp+220h] [xbp-A0h]
  __int64 v120[9]; // [xsp+228h] [xbp-98h] BYREF
 
  v120[8] = *(_QWORD *)(_ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2)) + 40);
  v5 = *(const char **)(a1 + 16);
  v7 = a2;
  v8 = -474758095;
  v9 = (const char *)(a1 + 1);
  if ( ((*(_BYTE *)a1 ^ 0xFE) & *(_BYTE *)a1) != 0 )
    v10 = 1056576168;
  else
    v10 = 529704559;
  v11 = -474758095;
  do
  {
    while ( 1 )
    {
      v12 = v11;
      v13 = a2;
      v11 = 1499283521;
      while ( v12 <= 529704558 )
      {
        v14 = v12 == -474758095;
        v12 = v10;
        if ( !v14 )
        {
          while ( 1 )
            ;
        }
      }
      if ( v12 != 529704559 )
        break;
      a2 = (const char *)(a1 + 1);
    }
    a2 = *(const char **)(a1 + 16);
  }
  while ( v12 == 1056576168 );
  v15 = -474758095;
  do
  {
    while ( 1 )
    {
      v16 = a2;
      v17 = v15;
      while ( v17 <= 529704558 )
      {
        v14 = v17 == -474758095;
        v17 = v10;
        if ( !v14 )
        {
          while ( 1 )
            ;
        }
      }
      if ( v17 != 529704559 )
        break;
      a2 = v9;
      v15 = 1499283521;
    }
    a2 = v5;
    v15 = 1499283521;
  }
  while ( v17 == 1056576168 );
  v18 = strlen(v16);
  sub_32C14(v19, v13, v18, &v118);              // MD5
  v20 = sub_8620(v111, &v118, 16LL);
  v118 = 0LL;
  v119 = 0LL;
  v22 = *(_QWORD **)(a3 + 16);
  v23 = (_QWORD *)(a3 + 1);
  if ( (~*(_BYTE *)a3 | 0xFFFFFFFE) == 0xFFFFFFFF )
    v24 = 529704559;
  else
    v24 = 1056576168;
  v25 = -474758095;
  do
  {
    while ( 1 )
    {
      v26 = v20;
      v27 = v25;
      while ( v27 <= 529704558 )
      {
        v14 = v27 == -474758095;
        v27 = v24;
        if ( !v14 )
        {
          while ( 1 )
            ;
        }
      }
      if ( v27 != 529704559 )
        break;
      v20 = v23;
      v25 = 1499283521;
    }
    v20 = v22;
    v25 = 1499283521;
  }
  while ( v27 == 1056576168 );
  v28 = -474758095;
  do
  {
    while ( 1 )
    {
      v29 = v21;
      v30 = v28;
      while ( v30 <= 529704558 )
      {
        v14 = v30 == -474758095;
        v30 = v24;
        if ( !v14 )
        {
          while ( 1 )
            ;
        }
      }
      if ( v30 != 529704559 )
        break;
      v21 = (const char *)v23;
      v28 = 1499283521;
    }
    v21 = (const char *)v22;
    v28 = 1499283521;
  }
  while ( v30 == 1056576168 );
  v31 = strlen(v29);
  sub_32C14(v32, v26, v31, &v118);              // MD5
  v33 = sub_8620(v110, &v118, 16LL);
  v118 = 0LL;
  v119 = 0LL;
  v35 = (_QWORD *)*((_QWORD *)v7 + 2);
  v36 = v7 + 1;
  if ( ((*v7 ^ 0xFE) & *v7) != 0 )
    v37 = 1056576168;
  else
    v37 = 529704559;
  v38 = -474758095;
  do
  {
    while ( 1 )
    {
      v39 = v33;
      v40 = v38;
      while ( v40 <= 529704558 )
      {
        v14 = v40 == -474758095;
        v40 = v37;
        if ( !v14 )
        {
          while ( 1 )
            ;
        }
      }
      if ( v40 != 529704559 )
        break;
      v33 = v36;
      v38 = 1499283521;
    }
    v33 = v35;
    v38 = 1499283521;
  }
  while ( v40 == 1056576168 );
  v41 = -474758095;
  do
  {
    while ( 1 )
    {
      v42 = v34;
      v43 = v41;
      while ( v43 <= 529704558 )
      {
        v14 = v43 == -474758095;
        v43 = v37;
        if ( !v14 )
        {
          while ( 1 )
            ;
        }
      }
      if ( v43 != 529704559 )
        break;
      v34 = (const char *)v36;
      v41 = 1499283521;
    }
    v34 = (const char *)v35;
    v41 = 1499283521;
  }
  while ( v43 == 1056576168 );
  v44 = strlen(v42);
  sub_32C14(v45, v39, v44, &v118);              // MD5
  sub_8620(src, &v118, 16LL);
  v46 = sub_6F20(v120, src);
  if ( (~LOBYTE(v111[0]) | 0xFFFFFFFE) == 0xFFFFFFFF )
    v48 = 529704559;
  else
    v48 = 1056576168;
  v49 = -474758095;
  do
  {
    while ( 1 )
    {
      v50 = v46;
      v51 = v49;
      while ( v51 <= 529704558 )
      {
        v14 = v51 == -474758095;
        v51 = v48;
        if ( !v14 )
        {
          while ( 1 )
            ;
        }
      }
      if ( v51 != 529704559 )
        break;
      v46 = (__int64 *)((char *)v111 + 1);
      v49 = 1499283521;
    }
    v46 = (__int64 *)v112;
    v49 = 1499283521;
  }
  while ( v51 == 1056576168 );
  if ( (v111[0] & 1) != 0 )
    v52 = 1552367478;
  else
    v52 = 132625284;
  v53 = -1135239934;
  do
  {
    while ( 1 )
    {
      v54 = v53;
      if ( v53 <= 132625283 )
        break;
      if ( v53 == 132625284 )
      {
        v53 = -1840677486;
        v47 = (unsigned __int64)LOBYTE(v111[0]) >> 1;
      }
      else
      {
        v53 = -1840677486;
        v47 = v111[1];
      }
    }
    v53 = v52;
  }
  while ( v54 == -1135239934 );
  if ( v54 != -1840677486 )
  {
    while ( 1 )
      ;
  }
  v55 = sub_9538((int)v120, v50, v47);
  v108 = *(void **)(v55 + 16);
  v56 = *(_OWORD *)v55;
  v57 = 0;
  v113 = v55;
  v107 = v56;
  while ( 1 )
  {
    v114 = v57;
    v58 = v57 >= 3 ? -1129254591 : 1805009445;
    if ( v58 == -1129254591 )
      break;
    *(_QWORD *)(v113 + 8LL * v114) = 0LL;
    v57 = v114 + 1;
  }
  if ( ((LOBYTE(v120[0]) ^ 0xFE) & v120[0]) != 0 )
    v59 = 1202870824;
  else
    v59 = -946146110;
  while ( v59 == 1202870824 )
  {
    operator delete((void *)v120[2]);
    v59 = -946146110;
  }
  v60 = (char *)memset(v117, 0, 0x81uLL);
  if ( (~(_BYTE)v107 | 0xFFFFFFFE) == 0xFFFFFFFF )
    v62 = 529704559;
  else
    v62 = 1056576168;
  v63 = -474758095;
  do
  {
    while ( 1 )
    {
      v64 = v60;
      v65 = v63;
      while ( v65 <= 529704558 )
      {
        v14 = v65 == -474758095;
        v65 = v62;
        if ( !v14 )
        {
          while ( 1 )
            ;
        }
      }
      if ( v65 != 529704559 )
        break;
      v60 = (char *)&v107 + 1;

		
								
				
				回复或点赞可查看完整内容
			
			
				
	

[培训]Windows内核深度攻防：从Hook技术到Rootkit实战！

		最后于  2025-10-12 16:42		
				被易之生生编辑
				
		，原因： 		
	

		#基础理论
		#逆向分析
		#NDK分析
		#协议分析
	

收藏・52

免费・46

支持

赞赏记录

参与人

雪币

留言

时间

mb_vafyxpvo

期待更多优质内容的分享，论坛有你更精彩！

2025-11-26 13:49

梧桐生

为你点赞！

2025-11-24 16:05

GoKu123

感谢你分享这么好的资源！

2025-11-3 11:35

孤独的街

感谢你的贡献，论坛因你而更加精彩！

2025-11-3 01:07

mb_mgqwqkuo

你的帖子非常有用，感谢分享！

2025-10-13 11:03

皮皮虾啊

感谢你的积极参与，期待更多精彩内容！

2025-10-12 09:59

npc0vo

非常支持你的观点！

2025-9-24 00:50

Editor

期待更多优质内容的分享，论坛有你更精彩！

2025-9-15 21:18

道友请留步

为你点赞！

2025-8-31 20:51

iCookiie

非常支持你的观点！

2025-8-28 09:50

mb_klpmfoof

为你点赞！

2025-8-26 17:42

mb_dazhmgfm

谢谢你的细致分析，受益匪浅！

2025-8-15 15:26

mb_dzfuvjol

感谢你分享这么好的资源！

2025-8-13 21:09

passself

感谢你的贡献，论坛因你而更加精彩！

2025-8-13 10:09

开胃小菜Wx

这个讨论对我很有帮助，谢谢！

2025-8-12 23:13

mb_lqbdyaym

你的分享对大家帮助很大，非常感谢！

2025-8-12 14:23

mb_pmhzmbyz

感谢你的贡献，论坛因你而更加精彩！

2025-8-11 17:08

@=llfly

你的帖子非常有用，感谢分享！

2025-8-11 17:01

wx_阿白_316

谢谢你的细致分析，受益匪浅！

2025-8-10 23:15

夏男人

感谢你的贡献，论坛因你而更加精彩！

2025-8-9 17:50

清风jw

这个讨论对我很有帮助，谢谢！

2025-8-9 01:18

braintrust

你的帖子非常有用，感谢分享！

2025-8-8 20:16

岁月。

感谢你的贡献，论坛因你而更加精彩！

2025-8-8 12:33

wx_byte

为你点赞！

2025-8-8 11:45

带壳的蜗牛

非常支持你的观点！

2025-8-6 21:12

mb_dmmgrgze

感谢你的贡献，论坛因你而更加精彩！

2025-8-6 17:50

houjingyi

感谢你分享这么好的资源！

2025-8-6 17:12

mb_lkavhmgb

非常支持你的观点！

2025-8-6 14:04

小七烤地瓜

感谢你的贡献，论坛因你而更加精彩！

2025-8-6 13:54

mb_bppcorlj

非常支持你的观点！

2025-8-6 12:35

mb_rjdrqvpa

感谢你的积极参与，期待更多精彩内容！

2025-8-6 12:00

Bonnie-Ran

为你点赞！

2025-8-6 02:07

zengxianxi

期待更多优质内容的分享，论坛有你更精彩！

2025-8-6 00:34

陈可牛

非常支持你的观点！

2025-8-5 21:53

mb_xonmbqnm

期待更多优质内容的分享，论坛有你更精彩！

2025-8-5 18:41

杨如画

这个讨论对我很有帮助，谢谢！

2025-8-5 16:44

doduhuang

期待更多优质内容的分享，论坛有你更精彩！

2025-8-5 16:43

伟叔叔

这个讨论对我很有帮助，谢谢！

2025-8-5 14:26

ChuXinﻬ.

为你点赞！

2025-8-5 14:17

CCC_

你的分享对大家帮助很大，非常感谢！

2025-8-5 14:09

醉染

感谢你的贡献，论坛因你而更加精彩！

2025-8-5 14:06

令狐双

谢谢你的细致分析，受益匪浅！

2025-8-5 13:54

顽劣

感谢你的贡献，论坛因你而更加精彩！

2025-8-5 13:52

godiand

你的帖子非常有用，感谢分享！

2025-8-5 13:41

huangyalei

非常支持你的观点！

2025-8-5 13:36

mb_cfjwplfo

你的分享对大家帮助很大，非常感谢！

2025-8-5 13:19

最新回复 (32) 1 2 ▶
丶咖啡猫丶雪币： 2370 活跃值： (2936) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 129 粉丝 3 关注私信	丶咖啡猫丶 2 楼 66666 2025-8-5 14:55 0
Imxz 雪币： 104 活跃值： (7189) 能力值： ( LV2，RANK：10 ) 在线值：发帖 6 回帖 374 粉丝 7 关注私信	Imxz 3 楼 666 2025-8-5 16:31 0
mb_ldbucrik 雪币： 7 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 491 粉丝 5 关注私信	mb_ldbucrik 4 楼感谢分享 2025-8-5 17:14 0
mb_dybhojzi 雪币： 213 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 27 粉丝 0 关注私信	mb_dybhojzi 5 楼 6666 2025-8-5 17:33 0
MaYil 雪币： 8645 活跃值： (6402) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 369 粉丝 2 关注私信	MaYil 6 楼感谢分享 2025-8-5 17:34 0
tomtory 雪币： 12798 活跃值： (4715) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 157 粉丝 1 关注私信	tomtory 7 楼感谢分享 2025-8-5 17:34 0
mb_uvyukvot 雪币： 209 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 85 粉丝 1 关注私信	mb_uvyukvot 8 楼 666 2025-8-6 14:42 0
wx_插曲雪币： 204 能力值： ( LV1，RANK：0 ) 在线值：发帖 1 回帖 177 粉丝 5 关注私信	wx_插曲 9 楼 666 2025-8-6 15:33 0
mb_tmbvnlxt 雪币： 193 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 42 粉丝 0 关注私信	mb_tmbvnlxt 10 楼 666 2025-8-6 15:42 0
机车王子雪币： 31 能力值： ( LV1，RANK：0 ) 在线值：发帖 1 回帖 39 粉丝 3 关注私信	机车王子 11 楼期待更多优质内容的分享，论坛有你更精彩！ 2025-8-6 15:58 0
AK1988DA 雪币： 77 活跃值： (425) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 51 粉丝 0 关注私信	AK1988DA 12 楼 1 2025-8-6 19:18 0
erichyx 雪币： 4184 活跃值： (3980) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 22 粉丝 2 关注私信	erichyx 13 楼 666 2025-8-6 19:21 0
mb_cbgtaveo 雪币： 293 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 138 粉丝 0 关注私信	mb_cbgtaveo 14 楼 6666 2025-8-6 20:41 0
上官兮唐雪币： 425 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 38 粉丝 0 关注私信	上官兮唐 15 楼 666 2025-8-6 20:56 0
wx_huhu_859 雪币： 260 能力值： ( LV1，RANK：0 ) 在线值：发帖 1 回帖 87 粉丝 1 关注私信	wx_huhu_859 16 楼 1 2025-8-6 21:04 0
kingking888 雪币： 2437 活跃值： (4703) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 157 粉丝 5 关注私信	kingking888 17 楼 666 2025-8-6 22:51 0
mb_yqsvfqmf 雪币： 42 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 71 粉丝 1 关注私信	mb_yqsvfqmf 18 楼可以私聊吗 2025-8-7 06:45 0
System's 雪币： 115 活跃值： (930) 能力值： ( LV2，RANK：10 ) 在线值：发帖 3 回帖 48 粉丝 2 关注私信	System's 19 楼 666不错 2025-8-10 22:35 0
肖安111 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 28 粉丝 0 关注私信	肖安111 20 楼 666 2025-8-11 11:04 0
bluegatar 雪币： 2 活跃值： (3843) 能力值： ( LV2，RANK：10 ) 在线值：发帖 4 回帖 203 粉丝 6 关注私信	bluegatar 21 楼 66666 2025-8-12 21:39 0
mb_hzvwwcvh 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 3 粉丝 0 关注私信	mb_hzvwwcvh 22 楼 666 2025-8-20 19:43 0
lotus* 雪币： 42 能力值： ( LV1，RANK：0 ) 在线值：发帖 1 回帖 45 粉丝 4 关注私信	lotus* 23 楼 666 2025-9-18 17:42 0
qq戚导雪币： 39 活跃值： (875) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 8 粉丝 0 关注私信	qq戚导 24 楼 666 2025-9-22 18:21 0
mb_mrjjcxgk 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 81 粉丝 0 关注私信	mb_mrjjcxgk 25 楼 66 2025-9-23 09:36 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

易之生生

发帖

回帖

177

RANK

关注

私信

他的文章

关于我们

联系我们

企业服务

看雪公众号

最新回复 (32) 1 2 ▶
丶咖啡猫丶雪币： 2370 活跃值： (2936) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 129 粉丝 3 关注私信	丶咖啡猫丶 2 楼 66666 2025-8-5 14:55 0
Imxz 雪币： 104 活跃值： (7189) 能力值： ( LV2，RANK：10 ) 在线值：发帖 6 回帖 374 粉丝 7 关注私信	Imxz 3 楼 666 2025-8-5 16:31 0
mb_ldbucrik 雪币： 7 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 491 粉丝 5 关注私信	mb_ldbucrik 4 楼感谢分享 2025-8-5 17:14 0
mb_dybhojzi 雪币： 213 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 27 粉丝 0 关注私信	mb_dybhojzi 5 楼 6666 2025-8-5 17:33 0
MaYil 雪币： 8645 活跃值： (6402) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 369 粉丝 2 关注私信	MaYil 6 楼感谢分享 2025-8-5 17:34 0
tomtory 雪币： 12798 活跃值： (4715) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 157 粉丝 1 关注私信	tomtory 7 楼感谢分享 2025-8-5 17:34 0
mb_uvyukvot 雪币： 209 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 85 粉丝 1 关注私信	mb_uvyukvot 8 楼 666 2025-8-6 14:42 0
wx_插曲雪币： 204 能力值： ( LV1，RANK：0 ) 在线值：发帖 1 回帖 177 粉丝 5 关注私信	wx_插曲 9 楼 666 2025-8-6 15:33 0
mb_tmbvnlxt 雪币： 193 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 42 粉丝 0 关注私信	mb_tmbvnlxt 10 楼 666 2025-8-6 15:42 0
机车王子雪币： 31 能力值： ( LV1，RANK：0 ) 在线值：发帖 1 回帖 39 粉丝 3 关注私信	机车王子 11 楼期待更多优质内容的分享，论坛有你更精彩！ 2025-8-6 15:58 0
AK1988DA 雪币： 77 活跃值： (425) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 51 粉丝 0 关注私信	AK1988DA 12 楼 1 2025-8-6 19:18 0
erichyx 雪币： 4184 活跃值： (3980) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 22 粉丝 2 关注私信	erichyx 13 楼 666 2025-8-6 19:21 0
mb_cbgtaveo 雪币： 293 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 138 粉丝 0 关注私信	mb_cbgtaveo 14 楼 6666 2025-8-6 20:41 0
上官兮唐雪币： 425 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 38 粉丝 0 关注私信	上官兮唐 15 楼 666 2025-8-6 20:56 0
wx_huhu_859 雪币： 260 能力值： ( LV1，RANK：0 ) 在线值：发帖 1 回帖 87 粉丝 1 关注私信	wx_huhu_859 16 楼 1 2025-8-6 21:04 0
kingking888 雪币： 2437 活跃值： (4703) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 157 粉丝 5 关注私信	kingking888 17 楼 666 2025-8-6 22:51 0
mb_yqsvfqmf 雪币： 42 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 71 粉丝 1 关注私信	mb_yqsvfqmf 18 楼可以私聊吗 2025-8-7 06:45 0
System's 雪币： 115 活跃值： (930) 能力值： ( LV2，RANK：10 ) 在线值：发帖 3 回帖 48 粉丝 2 关注私信	System's 19 楼 666不错 2025-8-10 22:35 0
肖安111 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 28 粉丝 0 关注私信	肖安111 20 楼 666 2025-8-11 11:04 0
bluegatar 雪币： 2 活跃值： (3843) 能力值： ( LV2，RANK：10 ) 在线值：发帖 4 回帖 203 粉丝 6 关注私信	bluegatar 21 楼 66666 2025-8-12 21:39 0
mb_hzvwwcvh 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 3 粉丝 0 关注私信	mb_hzvwwcvh 22 楼 666 2025-8-20 19:43 0
lotus* 雪币： 42 能力值： ( LV1，RANK：0 ) 在线值：发帖 1 回帖 45 粉丝 4 关注私信	lotus* 23 楼 666 2025-9-18 17:42 0
qq戚导雪币： 39 活跃值： (875) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 8 粉丝 0 关注私信	qq戚导 24 楼 666 2025-9-22 18:21 0
mb_mrjjcxgk 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 81 粉丝 0 关注私信	mb_mrjjcxgk 25 楼 66 2025-9-23 09:36 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复