mkv

kks data validator

mkv
Sep 23rd, 2014
349
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 1.98 KB | None | 0 0
  1. #1 imul ecx, 1000193h
  2. #2 movsx eax, al
  3. #3 inc edi
  4. #4 xor ecx, eax
  5. #5 mov al, [edi]
  6. #6 test al, al
  7. #7 jnz short 17354d0h #1
  8.  
  9. EAX - Accumulator - I/O port access, arithmetic, interrupt calls, etc
  10. EBX - Base - pointer for memory access, some interrupt return values
  11. ECX - Counter - loop counter and shifts, some interrupt values
  12. EDX - Data - I/O port access, arithmetic, some interrupt calls
  13. CF - Carry -
  14. PF - Parity -
  15. SF - Sign -
  16. OF - Overflow -
  17.  
  18. imul ecx, asdf
  19. signed multiply ASDF into ECX
  20. AL * byte = AX
  21. AX * word = DX:AX
  22. EAX*dword = EDX:EAX
  23. ecx_from CPSO ecx_to CPSO
  24. 1 811C9DC5 0100 => 050C5D1F 1001
  25. 2 050C5D64 0100 => 5677046C 1001
  26. 3 5677044E 0100 => 6B5BC6CA 1001
  27. 4 6B5BC6BE 0100 => BF79DD1A 1011
  28. 5 BF79DD45 0100 => B1D7539F 1111
  29. 6 B1D753FC 0000 => F1F935B4 1111
  30. 7 F1F935D5 0000 => C04FBE4F 1011
  31. 8 C04FBE3C 0100 => F9887874 1011
  32. # DETERMINED USAGE:
  33. randomize ecx
  34.  
  35. movsx eax, al
  36. MOV with sign extend
  37. copy al to eax
  38. al is smaller than eax
  39. eax must be a register
  40. al can be register or mem loc
  41. eax and al are considered signed
  42. 1 1597b => 7b
  43. 2 22 => 22
  44. 3 74 => 74
  45. 4 5f => 5f
  46. 5 63 => 63
  47. 6 61 => 61
  48. 7 73 => 73
  49. 8 74 => 74
  50. # DETERMINED USAGE:
  51. chomp EAX to LSB
  52.  
  53. inc edi
  54. 1 31D4EC68 => 31D4EC69
  55. 2 31D4EC69 => 31D4EC6A
  56. 3 31D4EC6A => 31D4EC6B
  57. 4 increasing linearly
  58. # DETERMINED USAGE:
  59. pointer to memory location
  60.  
  61. xor ecx, eax
  62. XOR EAX into ECX
  63. 1 050C5D1F ^= 0000007B = 050C5D64
  64. 2 5677046C ^= 00000022 = 5677044E
  65. 3 6B5BC6CA ^= 00000074 = 6B5BC6BE
  66. 4 BF79DD1A ^= 0000005F = BF79DD45
  67. 5 B1D7539F ^= 00000063 = B1D753FC
  68. 6 F1F935B4 ^= 00000061 = F1F935D5
  69. 7 C04FBE4F ^= 00000073 = C04FBE3C
  70. 8 F9887874 ^= 00000074 = F9887800
  71. # DETERMINED USAGE:
  72. shitty crypto
  73.  
  74. mov al, [edi]
  75. copy value at EDI into AL (EAX)
  76. 1 0000007B => 00000022
  77. 2 00000022 => 00000074
  78. 3 0000005F
  79. 4 00000063
  80. 5 00000061
  81. 6 00000073
  82. 7 00000074
  83. 8 00000022
  84.  
  85. test al, al
  86. AL AND AL
  87.  
  88.  
  89. jnz short
Advertisement
Add Comment
Please, Sign In to add comment