Skip to content

Instantly share code, notes, and snippets.

@elecyb
Created May 9, 2012 01:48
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save elecyb/2641087 to your computer and use it in GitHub Desktop.
Save elecyb/2641087 to your computer and use it in GitHub Desktop.
Process Check
bool __thiscall ProcCheckReal(ProcCheckInfo *this)
{
int procAddress; // eax@1
unsigned int v2; // ecx@1
ProcCheckInfo *v3; // ebx@1
signed int v5; // eax@6
int v6; // edx@6
char *v7; // ecx@6
int v8; // esi@6
int v9; // esi@10
int v10; // eax@11
int v11; // edx@11
int v12; // ecx@11
int v13; // eax@13
int v14; // edx@13
int v15; // ecx@13
int v16; // edx@15
int v17; // ecx@15
signed int v18; // eax@17
char newHash[20]; // [sp+Ch] [bp-15Ch]@1
SHA1 sha1; // [sp+20h] [bp-148h]@6
HMACSHA1 hmac; // [sp+80h] [bp-E8h]@6
unsigned int v22; // [sp+164h] [bp-4h]@1
v22 = (unsigned int)newHash ^ dword_409000;
v3 = this;
procAddress = this->procAddress;
v2 = 0;
do
{
if ( *(_BYTE *)procAddress != 0x90u )
break;
++v2;
++procAddress;
}
while ( v2 < 6 );
if ( (*(_BYTE *)procAddress | 1) != 0xE9u )
return 0;
v8 = *(_DWORD *)(procAddress + 1) + procAddress + 5;
HMACSHA1__Init(&hmac, v3->seed);
SHA1__Update(v8 + v3->address, (int)&hmac, v3->length);
SHA1__Final(&hmac, newHash);
sha1.data[0] = 0; // SHA1::Init
sha1.data[1] = 0;
sha1.data[2] = 0x67452301u;
sha1.data[3] = 0xEFCDAB89u;
sha1.data[4] = 0x98BADCFEu;
sha1.data[5] = 0x10325476u;
sha1.data[6] = 0xC3D2E1F0u;
SHA1__Update((int)&hmac.data[40], (int)&sha1, 64u);// data[40] is internal HMACSHA1 data
SHA1__Update((int)newHash, (int)&sha1, 20u); // SHA1(hmacHash)
SHA1__Final(&sha1, newHash);
v7 = v3->hash;
v5 = 20;
v6 = (int)newHash;
do
{
if ( *(_DWORD *)v6 != *(_DWORD *)v7 )
goto LABEL_10;
v5 -= 4;
v7 += 4;
v6 += 4;
}
while ( (unsigned int)v5 >= 4 );
if ( !v5 )
{
LABEL_19:
v18 = 0;
return v18 == 0;
}
LABEL_10:
v9 = *(_BYTE *)v6 - (unsigned __int8)*v7;
if ( *(_BYTE *)v6 == (unsigned __int8)*v7 )
{
v10 = v5 - 1;
v12 = (int)(v7 + 1);
v11 = v6 + 1;
if ( !v10
|| (v9 = *(_BYTE *)v11 - *(_BYTE *)v12, *(_BYTE *)v11 == *(_BYTE *)v12)
&& ((v13 = v10 - 1, v15 = v12 + 1, v14 = v11 + 1, !v13)
|| (v9 = *(_BYTE *)v14 - *(_BYTE *)v15, *(_BYTE *)v14 == *(_BYTE *)v15)
&& ((v17 = v15 + 1, v16 = v14 + 1, v13 == 1)
|| (v9 = *(_BYTE *)v16 - *(_BYTE *)v17, *(_BYTE *)v16 == *(_BYTE *)v17))) )
goto LABEL_19;
}
v18 = 1;
if ( v9 <= 0 )
v18 = -1;
return v18 == 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment