Java如何反混淆shift和&价值观？
可以说我得到了这个（来自java混淆），具有高度溢出的移位值
x = buffer[count + -3] << 0x8f553768 & 0xff00
通过尝试我发现了这一点..
8 = 0x ff 00
16 = 0x ff 00 00
24 = 0x ff 00 00 00
几乎我正在反混淆看起来像这样。
x = ((buffer[coint - 3] << 8) & 0xff)
我得到了大部分工作，就像将 [+ -] 翻转为 [- +] 所有这些都很容易修复。 但这些转变确实让我很困难。
我发现了一种在值上使用 AND 的技术，例如 0x8f553768 & 31 给出了 8 等的正确答案。 然后我将 0xff00 转换为无符号字节的等效值..即 0xff
我的问题是如何将位掩码降低到正确的值..说这个例子
i1 << 0xf7c13d2a & 0xfc00 //Aka 0xf7c13d2a & 31 == 10
我开始思考..
i1 << 10 & 0xfc00
如何将 0xfc00 降低到正确的值？
我猜测应该是这样的，
i1 << 10 & 0x3f
但是降低 AND 值的公式是什么？
Lets say I got this for example (from java obfuscation) with a highly overflowed shift value
x = buffer[count + -3] << 0x8f553768 & 0xff00
From trying I figured this out..
8 = 0x ff 00
16 = 0x ff 00 00
24 = 0x ff 00 00 00
pretty much I am deobfuscatating to look like this.
x = ((buffer[coint - 3] << 8) & 0xff)
I got most of it working like flipping the [+ -] to [- +] all this is easy to fix..
But these shifts are really giving me a hard time.
I found a technique of using AND on the value like0x8f553768 & 31 which gives the proper answer of 8 etc..
Then I would convert 0xff00 to the equivalent of unsigned byte.. which is 0xff
My question is how do I lower the bitmasks to it's proper values.. say this example
i1 << 0xf7c13d2a & 0xfc00 //Aka 0xf7c13d2a & 31 == 10
which I got down to..
i1 << 10 & 0xfc00
how do I lower the 0xfc00 to it's proper value?
I took a guess should look like this
i1 << 10 & 0x3f
but whats the formula to lower AND values?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
哈哈解决了我的大脑在头脑中进行了计算..
该死的为什么答案对我来说如此困难..
i1 << 10& 0xfc00然后你就可以
0xfc00 >>> 10为您提供0x3fHaha solved my brain did the calculation in its head..
damn why do answers come so hard for me..
i1 << 10 & 0xfc00then you do
0xfc00 >> 10which gives you0x3f