大佬们可以帮忙看下ida里面的伪代码嘛

if ( v9 == 4 )
{
v77 = &v15;
v76 = “/abc”;
v79 = &v15;
v78 = “/abc”;
v80 = &v15;
v81 = &v15;
v82 = &v15;
v83 = &v15;
v17 = 0LL;
v16 = 0LL;
*(_QWORD *)&v15 = 0LL;
v5 = v26;
v6 = std::__1::char_traits::length("/abc");
std::__1::basic_string<char,std::__1::char_traits,std::__1::allocator>::__init(&v15, “/abc”, v6);
v85 = &v12;
v84 = “/ok/abc”;
v87 = &v12;
v86 = “/ok/abc”;
v88 = &v12;
v89 = &v12;
v90 = &v12;
v91 = &v12;
v14 = 0LL;
v13 = 0LL;
v12 = 0LL;
v7 = std::__1::char_traits::length("/ok/abc");
std::__1::basic_string<char,std::__1::char_traits,std::__1::allocator>::__init(
&v12,
“/ok/abc”,
v7);
str_replace(v5, (__int64)&v15, &v12);
std::__1::basic_string<char,std::__1::char_traits,std::__1::allocator>::~basic_string(&v12);
std::__1::basic_string<char,std::__1::char_traits,std::__1::allocator>::~basic_string(&v15);
}

上面是我从ida里复制出来的伪代码,看着像是c语言实现的,有大佬知道具体是什么意思吗,能否还原下代码,谢谢了。

这是C++吧。

字符串拼接啥的

感觉混淆了

嗯,看着是c++的,大概意思好像了解到是字符串替换有关的。但是不知道源码是如何实现的,希望有懂的可以给点思路

std::string v15 = "/abc";
std::string v12 = "/ok/abc";

str_replace(v5, v15, v12);

关键是你的v5和str_replace是啥玩意

谢谢大佬回复,v5是传过来的原参数,上面有一点代码没贴上。现在看了你简化后的,大致已经了解了。就是传过来一个原始的参数,然后对比替换成另外的字符串。平时用ida看伪代码后都是oc有关的。突然跑出来c++这个感觉不会还原了。:joy:

str_replace 代码如下,看了这个头更大了,不知道内部是如何替换的

__int64 __fastcall str_replace(__int64 a1, __int64 a2, __int64 *a3)
{
__int64 result; // x0
__int64 v4; // [xsp+10h] [xbp-470h]
__int64 *v5; // [xsp+28h] [xbp-458h]
unsigned __int64 v6; // [xsp+58h] [xbp-428h]
__int64 v7; // [xsp+78h] [xbp-408h]
unsigned __int64 v8; // [xsp+90h] [xbp-3F0h]
__int64 v9; // [xsp+A8h] [xbp-3D8h]
__int64 v10; // [xsp+C0h] [xbp-3C0h]
__int64 v11; // [xsp+D0h] [xbp-3B0h]
unsigned __int64 v12; // [xsp+F0h] [xbp-390h]
__int64 *v13; // [xsp+F8h] [xbp-388h]
__int64 v14; // [xsp+100h] [xbp-380h]
__int64 v15; // [xsp+108h] [xbp-378h]
signed __int64 v16; // [xsp+358h] [xbp-128h]

v15 = a1;
v14 = a2;
v13 = a3;
v12 = 0LL;
result = a2;
if ( *(_BYTE *)(a2 + 23) & 0x80 )
v11 = *(_QWORD *)(a2 + 8);
else
v11 = *(unsigned __int8 *)(a2 + 23);
if ( *((_BYTE *)a3 + 23) & 0x80 )
v10 = a3[1];
else
v10 = *((unsigned __int8 *)a3 + 23);
while ( 1 )
{
v9 = *(_BYTE *)(v15 + 23) & 0x80 ? *(_QWORD *)v15 : v15;
v8 = *(_BYTE *)(v15 + 23) & 0x80 ? *(_QWORD )(v15 + 8) : (unsigned __int64)(unsigned __int8 *)(v15 + 23);
v7 = *(_BYTE *)(v14 + 23) & 0x80 ? *(_QWORD *)v14 : v14;
v6 = *(_BYTE )(v14 + 23) & 0x80 ? (_QWORD )(v14 + 8) : (unsigned __int64)(unsigned __int8 )(v14 + 23);
if ( v12 <= v8 && v8 - v12 >= v6 )
{
if ( v6 )
{
result = std::__1::__search<bool (
)(char,char),char const
,char const
>(
v9 + v12,
v9 + v8,
v7,
v7 + v6,
std::__1::char_traits::eq);
v16 = result == v9 + v8 ? -1LL : result - v9;
}
else
{
v16 = v12;
}
}
else
{
v16 = -1LL;
}
if ( v16 == -1 )
break;
if ( *((_BYTE *)v13 + 23) & 0x80 )
v5 = (__int64 *)*v13;
else
v5 = v13;
if ( *((_BYTE *)v13 + 23) & 0x80 )
v4 = v13[1];
else
v4 = *((unsigned __int8 *)v13 + 23);
result = std::__1::basic_string<char,std::__1::char_traits,std::__1::allocator>::replace(
v15,
v16,
v11,
v5,
v4);
v12 = v16 + v10;
}
return result;
}

std::__1::basic_string<char,std::__1::char_traits,std::__1::allocator>::replace