简体   繁体   中英

Java how do you deobfuscatate shift and & values?

Lets say I got this for example (from java obfuscation) with a highly overflowed shift value

x = buffer[count + -3] << 0x8f553768 & 0xff00

From trying I figured this out..

8 = 0x ff 00

16 = 0x ff 00 00

24 = 0x ff 00 00 00

pretty much I am deobfuscatating to look like this.

x = ((buffer[coint - 3] << 8) & 0xff)

I got most of it working like flipping the [+ -] to [- +] all this is easy to fix.. But these shifts are really giving me a hard time.

I found a technique of using AND on the value like 0x8f553768 & 31 which gives the proper answer of 8 etc.. Then I would convert 0xff00 to the equivalent of unsigned byte.. which is 0xff

My question is how do I lower the bitmasks to it's proper values.. say this example

i1 << 0xf7c13d2a & 0xfc00      //Aka 0xf7c13d2a & 31 == 10

which I got down to..

i1 << 10 & 0xfc00

how do I lower the 0xfc00 to it's proper value?

I took a guess should look like this

i1 << 10 & 0x3f

but whats the formula to lower AND values?

Haha solved my brain did the calculation in its head..

damn why do answers come so hard for me..

i1 << 10 & 0xfc00

then you do

0xfc00 >> 10 which gives you 0x3f

The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.

 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM