What operator in IDC language (hmm may be there is the same in ANSI C) rotates operand?
>> is shr i guess...
and what is ror?
Posted on 2004-08-03 11:25:29 by happyfly
ror is rotate left and this is different from shr which is shift right. Say that there is a byte 0101. After ror 1, it would become 1010.
Posted on 2004-08-03 11:29:05 by roticv
ror is rotate left


ror is rotate right, rol is rotate left
Posted on 2004-08-03 11:30:41 by donkey
in ANSI C there is no rotation operator. only a shift left and a shift right.
Posted on 2004-08-03 11:30:44 by Mbee
thnx xlifewirex.
may be there is a way to rotate operand not using bit operations (and using only >>, <<, ~,^)?
Posted on 2004-08-03 11:41:18 by happyfly
If I am not wrong

x = x >> a || x << (32-a)

Or something like that
Posted on 2004-08-03 11:45:45 by roticv
i found it in my system some virus and its crypted by easy algorithm:
00405FED mov esi, offset dword_401000
00405FF2 mov edi, esi
00405FF4 mov ecx, 4FE2h
00405FF9 cld
00405FFA
00405FFA loc_405FFA: ; CODE XREF: start+1Bj
00405FFA lodsb
00405FFB ror al, 3
00405FFE xor al, 88h
00406000 stosb
00406001 loop loc_405FFA

and i never write IDC scripts before.
I know that hiew can help me to make it much faster, but i want to understand how to do it in IDA.
Posted on 2004-08-03 11:46:30 by happyfly
tnx roticv
ill try this one ;)
Posted on 2004-08-03 11:47:56 by happyfly
unfortunately it doesnt work :(
i made such a script:
#include <idc.idc>
#define b 0x401000
#define ror(x,a) (x >> a || x << (32-a))

static main()
{
auto c;
Message("Patching started...
");
for (c=0; c<=0x4fe2;c++)
PatchByte(b+c, (ror(Byte(b+c), 3))^0x88);
Message("Patched successfully
");
}

may be i made a mistake?
Posted on 2004-08-03 12:00:57 by happyfly
Since you are dealing with bytes, i think it should be

#define ror(x,a) (x >> a || x << (8-a))
Posted on 2004-08-03 12:04:26 by roticv
unfortunately it doesnt work too :(
i made prog on VC:
#include "stdafx.h"
#include <stdio.h>
#define ror(x,a) (x >> a || x << (8-a))


int main(int argc, char* argv[])
{
char z = 0x44;
printf("%X
",ror(z,3));
scanf("%x",&z);
return 0;
}
The result is 1 (hmm)
and i made prog on asm:
dbg equ int 3
mov al, 44h
ror al, 3
dbg
the result is 0x88
may be the formula u gave me is wrong?
Posted on 2004-08-03 12:30:24 by happyfly
i found the mistake...
the original formula is here: http://students.uniyar.ac.ru/~sunny/tutorial/c/c.html
its simple:
#define ROR(x,skew) x=(x>>(skew))|(x<<(8-(skew)))
Posted on 2004-08-03 12:45:27 by happyfly
so the script looks like (it works! :)) this:
#include <idc.idc>
#define b 0x401000
#define ror(x,a) (x >> a | x << (8-a))

static main()
{
auto c;
Message("Patching started...
");
for (c=0; c<=0x4fe2;c++)
PatchByte(b+c, (ror(Byte(b+c), 3))^0x88);
Message("Patched successfully
");
}
Posted on 2004-08-03 12:49:19 by happyfly
yes, i wanted to say that too. || is the logical operator, it returns only a true or false. | is the "normal" or you expected :)
Posted on 2004-08-04 02:58:50 by Mbee