Lets say I got this for example (from java obfuscation) with a highly overflowed shift value
x = buffer[count + -3] << 0x8f553768 & 0xff00
From trying I figured this out..
8 = 0x ff 00
16 = 0x ff 00 00
24 = 0x ff 00 00 00
pretty much I am deobfuscatating to look like this.
x = ((buffer[coint - 3] << 8) & 0xff)
I got most of it working like flipping the [+ -]
to [- +]
all this is easy to fix.. But these shifts are really giving me a hard time.
I found a technique of using AND on the value like 0x8f553768 & 31
which gives the proper answer of 8
etc.. Then I would convert 0xff00
to the equivalent of unsigned byte.. which is 0xff
My question is how do I lower the bitmasks to it's proper values.. say this example
i1 << 0xf7c13d2a & 0xfc00 //Aka 0xf7c13d2a & 31 == 10
which I got down to..
i1 << 10 & 0xfc00
how do I lower the 0xfc00
to it's proper value?
I took a guess
should look like this
i1 << 10 & 0x3f
but whats the formula to lower AND
values?
Haha solved my brain did the calculation in its head..
damn why do answers come so hard for me..
i1 << 10 & 0xfc00
then you do
0xfc00 >> 10
which gives you 0x3f
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.