Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- byte[] buf = new byte[jsonbuf.Length + 5];
- Array.Copy(jsonbuf, 0, buf, 4, jsonbuf.Length);
- buf[buf.Length - 1] = 0;
- xor2(buf, 0x39, 0x03);
- /* ---------------------
- @ eax 0001597B json len +pad?
- * ebx 323EEC68 json buf
- @ ecx 811C9DC5 seed
- * edx 323EEC68 json buf
- * esi 00015971 json len -csum -nul
- * edi 323EEC68 json buf
- * ebp 003EF22C ? 10 f7 3e 00
- * esp 003EF0CC ? eb 48 3f c3
- * eip 017654D0 TabFlow+2A0
- * efl 00000206 ?
- * ---ODITSZAPC
- * ---001000010
- * ---------------------
- * #1 imul ecx, 1000193h
- * #2 movsx eax, al
- * #3 inc edi
- * #4 xor ecx, eax
- * #5 mov al, [edi]
- * #6 test al, al
- * #7 jnz short 17354d0h #1
- * ----LOOP----
- * #8 cmp ecx, [ebp+var_124]
- * #9 jz valid_file
- * ---------------------
- * 811C9DC5 *=1000193
- * 050C5D1F ^=eax(7b)
- * 050C5D64
- * ---------------------
- * 050C5D64 *=1000193
- * 5677046C ^=eax(22)
- * 5677044E
- * 5677044E 6B5BC6CA 6B5BC6BE
- * 6B5BC6BE BF79DD1A BF79DD45
- * ---------------------
- * 7b 22 74 5f 63 61 73
- * " t _ c a s t
- */
- UInt32 len = (UInt32)(jsonbuf.Length + 0xB);
- byte eax = BitConverter.GetBytes(len)[0];
- eax = 0x7b;
- UInt32 ecx = 0x811C9DC5;
- byte[] csum = new byte[4];
- for (int edi = 4; edi < buf.Length; )
- {
- ecx *= 0x1000193;
- csum = BitConverter.GetBytes(ecx);
- csum[0] ^= BitConverter.GetBytes(eax)[0];
- if (eax >= 0x80) for (int a = 1; a < csum.Length; a++) csum[a] ^= 0xFF;
- ecx = BitConverter.ToUInt32(csum, 0);
- eax = (byte)(buf[++edi] ^ (edi % 2 == 0 ? 0x39 : 0x03));
- if (eax == 0) break;
- }
- //MessageBox.Show(ecx.ToString("x"));
- csum = BitConverter.GetBytes(ecx);
- Array.Copy(csum, buf, csum.Length);
- File.WriteAllBytes(fout, buf);
Advertisement
Add Comment
Please, Sign In to add comment