What operator in IDC language (hmm may be there is the same in ANSI C) rotates operand?
>> is shr i guess...
and what is ror?
>> is shr i guess...
and what is ror?
ror is rotate left and this is different from shr which is shift right. Say that there is a byte 0101. After ror 1, it would become 1010.
ror is rotate left
ror is rotate right, rol is rotate left
in ANSI C there is no rotation operator. only a shift left and a shift right.
thnx xlifewirex.
may be there is a way to rotate operand not using bit operations (and using only >>, <<, ~,^)?
may be there is a way to rotate operand not using bit operations (and using only >>, <<, ~,^)?
If I am not wrong
x = x >> a || x << (32-a)
Or something like that
x = x >> a || x << (32-a)
Or something like that
i found it in my system some virus and its crypted by easy algorithm:
00405FED mov esi, offset dword_401000
00405FF2 mov edi, esi
00405FF4 mov ecx, 4FE2h
00405FF9 cld
00405FFA
00405FFA loc_405FFA: ; CODE XREF: start+1Bj
00405FFA lodsb
00405FFB ror al, 3
00405FFE xor al, 88h
00406000 stosb
00406001 loop loc_405FFA
and i never write IDC scripts before.
I know that hiew can help me to make it much faster, but i want to understand how to do it in IDA.
00405FED mov esi, offset dword_401000
00405FF2 mov edi, esi
00405FF4 mov ecx, 4FE2h
00405FF9 cld
00405FFA
00405FFA loc_405FFA: ; CODE XREF: start+1Bj
00405FFA lodsb
00405FFB ror al, 3
00405FFE xor al, 88h
00406000 stosb
00406001 loop loc_405FFA
and i never write IDC scripts before.
I know that hiew can help me to make it much faster, but i want to understand how to do it in IDA.
tnx roticv
ill try this one ;)
ill try this one ;)
unfortunately it doesnt work :(
i made such a script:
#include <idc.idc>
#define b 0x401000
#define ror(x,a) (x >> a || x << (32-a))
static main()
{
auto c;
Message("Patching started...
");
for (c=0; c<=0x4fe2;c++)
PatchByte(b+c, (ror(Byte(b+c), 3))^0x88);
Message("Patched successfully
");
}
may be i made a mistake?
i made such a script:
#include <idc.idc>
#define b 0x401000
#define ror(x,a) (x >> a || x << (32-a))
static main()
{
auto c;
Message("Patching started...
");
for (c=0; c<=0x4fe2;c++)
PatchByte(b+c, (ror(Byte(b+c), 3))^0x88);
Message("Patched successfully
");
}
may be i made a mistake?
Since you are dealing with bytes, i think it should be
#define ror(x,a) (x >> a || x << (8-a))
#define ror(x,a) (x >> a || x << (8-a))
unfortunately it doesnt work too :(
i made prog on VC:
#include "stdafx.h"
#include <stdio.h>
#define ror(x,a) (x >> a || x << (8-a))
int main(int argc, char* argv[])
{
char z = 0x44;
printf("%X
",ror(z,3));
scanf("%x",&z);
return 0;
}
The result is 1 (hmm)
and i made prog on asm:
dbg equ int 3
mov al, 44h
ror al, 3
dbg
the result is 0x88
may be the formula u gave me is wrong?
i made prog on VC:
#include "stdafx.h"
#include <stdio.h>
#define ror(x,a) (x >> a || x << (8-a))
int main(int argc, char* argv[])
{
char z = 0x44;
printf("%X
",ror(z,3));
scanf("%x",&z);
return 0;
}
The result is 1 (hmm)
and i made prog on asm:
dbg equ int 3
mov al, 44h
ror al, 3
dbg
the result is 0x88
may be the formula u gave me is wrong?
i found the mistake...
the original formula is here: http://students.uniyar.ac.ru/~sunny/tutorial/c/c.html
its simple:
#define ROR(x,skew) x=(x>>(skew))|(x<<(8-(skew)))
the original formula is here: http://students.uniyar.ac.ru/~sunny/tutorial/c/c.html
its simple:
#define ROR(x,skew) x=(x>>(skew))|(x<<(8-(skew)))
so the script looks like (it works! :)) this:
#include <idc.idc>
#define b 0x401000
#define ror(x,a) (x >> a | x << (8-a))
static main()
{
auto c;
Message("Patching started...
");
for (c=0; c<=0x4fe2;c++)
PatchByte(b+c, (ror(Byte(b+c), 3))^0x88);
Message("Patched successfully
");
}
#include <idc.idc>
#define b 0x401000
#define ror(x,a) (x >> a | x << (8-a))
static main()
{
auto c;
Message("Patching started...
");
for (c=0; c<=0x4fe2;c++)
PatchByte(b+c, (ror(Byte(b+c), 3))^0x88);
Message("Patched successfully
");
}
yes, i wanted to say that too. || is the logical operator, it returns only a true or false. | is the "normal" or you expected :)