Giter Site home page Giter Site logo

Comments (3)

romansavrulin avatar romansavrulin commented on July 23, 2024

looks like this is related to #66 somehow?

from rz-ghidra.

ITAYC0HEN avatar ITAYC0HEN commented on July 23, 2024

I don't think these issues are related

from rz-ghidra.

XVilka avatar XVilka commented on July 23, 2024

I retried, but found no matching code in the attached binary - looks like function is from another place.

rizin -AA injector.exe
[0x00401a33]> pdg

// WARNING: [rz-ghidra] Var arg_8h is stack pointer based, which is not supported for decompilation.

int32_t fcn.00401a33(void)
{
    char cVar1;
    int16_t iVar2;
    code *pcVar3;
    int16_t *piVar4;
    int16_t *piVar5;
    int32_t iVar6;
    int32_t iVar7;
    char *pcVar8;
    int32_t iVar10;
    int16_t *piVar11;
    char *arg_ch;
    undefined4 uVar12;
    char *pcVar9;
    
    pcVar3 = _sym.imp.KERNEL32.dll_GetEnvironmentStringsW;
    iVar10 = 0;
    piVar11 = (int16_t *)0x0;
    arg_ch = (char *)0x0;
    if (*(int32_t *)0x4086c0 == 0) {
        piVar11 = (int16_t *)(*_sym.imp.KERNEL32.dll_GetEnvironmentStringsW)();
        if (piVar11 != (int16_t *)0x0) {
            *(int32_t *)0x4086c0 = 1;
code_r0x00401a8a:
            if ((piVar11 == (int16_t *)0x0) && (piVar11 = (int16_t *)(*pcVar3)(), piVar11 == (int16_t *)0x0)) {
                return 0;
            }
            pcVar3 = _sym.imp.KERNEL32.dll_WideCharToMultiByte;
            iVar2 = *piVar11;
            piVar5 = piVar11;
            while (iVar2 != 0) {
                do {
                    piVar4 = piVar5;
                    piVar5 = piVar4 + 1;
                } while (*piVar5 != 0);
                piVar5 = piVar4 + 2;
                iVar2 = *piVar5;
            }
            uVar12 = 0;
            iVar6 = (*_sym.imp.KERNEL32.dll_WideCharToMultiByte)
                              (0, 0, piVar11, ((int32_t)piVar5 - (int32_t)piVar11 >> 1) + 1, 0, 0, 0, 0);
            if (((iVar6 != 0) && (iVar7 = fcn.004023a0(iVar6), iVar7 != 0)) &&
               (iVar10 = iVar7, iVar6 = (*pcVar3)(0, 0, piVar11, uVar12, iVar7, iVar6, 0, 0), iVar6 == 0)) {
                fcn.00402240(iVar10);
                iVar10 = 0;
            }
            (*_sym.imp.KERNEL32.dll_FreeEnvironmentStringsW)(piVar11);
            return iVar10;
        }
        arg_ch = (char *)(*_sym.imp.KERNEL32.dll_GetEnvironmentStrings)();
        if (arg_ch == (char *)0x0) {
            return 0;
        }
        *(int32_t *)0x4086c0 = 2;
    } else {
        if (*(int32_t *)0x4086c0 == 1) goto code_r0x00401a8a;
        if (*(int32_t *)0x4086c0 != 2) {
            return 0;
        }
    }
    if ((arg_ch == (char *)0x0) &&
       (arg_ch = (char *)(*_sym.imp.KERNEL32.dll_GetEnvironmentStrings)(), arg_ch == (char *)0x0)) {
        return 0;
    }
    cVar1 = *arg_ch;
    pcVar8 = arg_ch;
    while (cVar1 != '\0') {
        do {
            pcVar9 = pcVar8;
            pcVar8 = pcVar9 + 1;
        } while (*pcVar8 != '\0');
        pcVar8 = pcVar9 + 2;
        cVar1 = *pcVar8;
    }
    iVar10 = fcn.004023a0(pcVar8 + (1 - (int32_t)arg_ch));
    if (iVar10 == 0) {
        iVar10 = 0;
    } else {
        fcn.004028c0(iVar10, (int32_t)arg_ch, (int32_t)(pcVar8 + (1 - (int32_t)arg_ch)));
    }
    (*_sym.imp.KERNEL32.dll_FreeEnvironmentStringsA)(arg_ch);
    return iVar10;
}
[0x00401a33]>

I think the issue is resolved. If not - feel free to reopen with description of the exact place where it occurs.

from rz-ghidra.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.