BYTE byte_103F95958;
unsigned char dword_103F95959[] =
{
0x00,
0x04,
0,
0,
0,
0,
3,
0,
0,
0,
0,
0,
0,
0,
0xD,
1,
0,
0,
0,
0xAF,
9,
0,
0,
0,
0x72 ,
0xAE,
...
};
__int64 sub_101F123456(int a1)
{
char *v1; // x9
char *v2; // x10
int v3; // w13
int v4; // t1
int v5; // w13
char *v6; // x13
signed int v7; // w13
int v8; // t1
int v10; // [xsp+Ch] [xbp-134h]
char v11; // [xsp+10h] [xbp-130h]
char v12[32]; // [xsp+110h] [xbp-30h]
v10 = a1;
v1 = &byte_103F95958;
v2 = &v11;
do
{
while ( 1 )
{
while ( 1 )
{
while ( 1 )
{
v7 = (unsigned __int8)*v1;
if ( v7 <= 130 )
break;
if ( v7 <= 174 )
{
if ( v7 == 131 )
{
*(_QWORD *)&v12[*(signed int *)(v1 + 1)] = *(_QWORD *)v2;
*(_DWORD *)&v12[*(signed int *)(v1 + 9)] = *(_DWORD *)(v1 + 5);
*(_QWORD *)v2 = *(_QWORD *)&v12[*(signed int *)(v1 + 13)];
v2 += 8;
*(_QWORD *)v2 = *(_QWORD *)(v1 + 17);
v1 += 25;
}
else if ( v7 == 174 )
{
v2 += 8;
if ( !*(_DWORD *)(v1 + 1) )
*(_QWORD *)v2 = (_QWORD)&v10;
LABEL_14:
v1 += 5;
}
}
else
{
switch ( v7 )
{
case 175:
v3 = *(_DWORD *)v2;
v4 = *((_DWORD *)v2 - 2);
v2 -= 8;
v5 = v4 + v3;
*(_DWORD *)v2 = v5;
*(_DWORD *)&v12[*(signed int *)(v1 + 1)] = v5;
*(_DWORD *)&v12[*(signed int *)(v1 + 13)] = *(_DWORD *)(v1 + 5) & *(_DWORD *)&v12[*(signed int *)(v1 + 9)];
v6 = &v12[*(signed int *)(v1 + 17)];
goto LABEL_12;
case 200:
*(_DWORD *)&v12[*(signed int *)(v1 + 5)] = **(_DWORD **)v2 ^ *(_DWORD *)&v12[*(signed int *)(v1 + 1)];
*(_DWORD *)v2 = *(_DWORD *)&v12[*(signed int *)(v1 + 9)] >> *(_DWORD *)(v1 + 13);
v1 += 17;
break;
case 213:
v8 = *(_DWORD *)v2;
v2 -= 8;
*(_DWORD *)&v12[*(signed int *)(v1 + 5)] = v8 ^ *(_DWORD *)&v12[*(signed int *)(v1 + 1)];
v1 += 9;
break;
}
}
}
if ( v7 > 42 )
break;
if ( v7 == 25 )
{
v1 += *(signed int *)(v1 + 1) + 1;
}
else if ( v7 == 34 )
{
*((_DWORD *)v2 - 2) = *(unsigned __int8 *)(*((_QWORD *)v2 - 1) + *(_QWORD *)v2 * *(signed int *)(v1 + 1));
*(_DWORD *)v2 = *(_DWORD *)&v12[*(signed int *)(v1 + 9)] << *(_DWORD *)(v1 + 5);
v1 += 13;
}
}
if ( v7 != 43 )
break;
*(_DWORD *)&v12[*(signed int *)(v1 + 5)] = *(_DWORD *)v2 ^ *(_DWORD *)&v12[*(signed int *)(v1 + 1)];
*(_QWORD *)v2 = *(_QWORD *)&v12[*(signed int *)(v1 + 9)];
v2 += 8;
v6 = *(char **)(v1 + 13);
LABEL_12:
*(_QWORD *)v2 = (_QWORD)v6;
v1 += 21;
}
if ( v7 == 48 )
{
*((_DWORD *)v2 + 2) = *(_DWORD *)&v12[*(signed int *)(v1 + 1)];
v2 += 8;
goto LABEL_14;
}
}
while ( v7 != 46 );
return *(unsigned int *)v2;
}
使用了一个静态数组来控制程序执行路径，我看了下，ollvm并没有这么做。
还有char v12[32]; 这个函数内的数组也是混淆器生成的。他每个混淆过的函数都有这么一个数组，我都没搞清楚这个是起到了什么作用。只是bcf模式生成的无用代码吗?
