📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  Help on Reversing Challenge

Topic created on: December 18, 2006 15:05 CST by doekia .

I am facing a VM. In VM opcode is implemented a SHA-1 hashing. I am targeting this code right now to decypher the VM opcode (the VM analyzer/interpreter is a beast).
Here below is the current challenge I am facing. If any of you have an idea what those opcode could be that might helps. I have spend so much time in this small section of code that I am going brain dead.

---8<-------8<------8<-------8<------8<-------8<------8<-------8<------8<-------8<---
hash_me+166  14 1E                          loadb   B, 1Eh
hash_me+168
hash_me+168                 rol30:                                       ; CODE XREF: hash_me+172j
hash_me+168  48                             one     _48_                 ; 48h and 08h are commonly found in return before test
hash_me+168                 ; ---------------------------------------------------------------------------
hash_me+169  C8                             db 0C8h ; +                  ; <-- x8h are usually 1byte opcode
hash_me+16A                 ; ---------------------------------------------------------------------------
hash_me+16A  D2 4F 01                       iif     _4FD2_, unk_6807A
hash_me+16D  08                             zero    _08_
hash_me+16D                 ; ---------------------------------------------------------------------------
hash_me+16E  C8             unk_6807A:      db 0C8h ; +                  ; CODE XREF: hash_me+16Aj
hash_me+16E                                                              ; <-- x8h are usually 1byte opcode
hash_me+16F  B2                             db 0B2h ; �
hash_me+170  61                             db  61h ; a
hash_me+171                 ; ---------------------------------------------------------------------------
hash_me+171  73                             dec     B
hash_me+172  E0 F4                          jr      NOT ZERO, rol30
hash_me+174  6E 08 02 0E                    loadl   dword_50E0208, A     ; C = B <<< 30

  igorsk     December 19, 2006 06:24.56 CST
Can't you just check what the opcode interpreter does for these opcodes?

  sa7ori     December 19, 2006 15:31.34 CST
yea, I privmsg'd him a similar question, I was under the impression that this was supposed to be a snippit of the interpreter...

  doekia   December 19, 2006 16:01.03 CST
Sorry guys, I misexpressed myself.
I know what this code is doing. It does a rol30 of an SHA hashing function. What I try to achieve is to identify the opcode action - i.e name them, so I can use that knowlege for other part of the code.
Unfortunatly I cannot quite follow the interpreter all the way thru since a portion is apparently in VM opcode.
Other portion of this SHA function have provided me with a lot of the logical operators which helped me a lot.
This rol30 portion is killing me...

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit