Reverse Engineering for Beginners

CHAPTER 77. HAND DECOMPILING + Z3 SMT SOLVER CHAPTER 77. HAND DECOMPILING + Z3 SMT SOLVER

rax=rcx;
rax=rdx;
rdx=0x388D76AEE8CB1500;
rax=_lrotr(rax, rax&0xF); // rotate right
rax^=rdx;
rdx=0xD2E9EE7E83C4285B;
rax=_lrotl(rax, rax&0xF); // rotate left
r8=rax+rdx;
rdx=0x8888888888888889;
rax=r8;
rax=rdx;
rdx=rdx>>5;
rax=rdx;
rcx=r8+rdx*4;
rax=rax<<6;
rcx=rcx-rax;
rax=r8
rax=_lrotl (rax, rcx&0xFF); // rotate left
return rax;
};

If you are careful enough, this code can be compiled and will even work in the same way as the original.

Then, we are going to rewrite it gradually, keeping in mind all registers usage. Attention and focus is very important
here—any tiny typo may ruin all your work!

Here is the first step:

uint64_t f(uint64_t input)
{
uint64_t rax, rbx, rcx, rdx, r8;

ecx=input;

rdx=0x5D7E0D1F2E0F1F84;

rax=rcx;

rax*=rdx;

rdx=0x388D76AEE8CB1500;

rax=_lrotr(rax, rax&0xF); // rotate right

rax^=rdx;

rdx=0xD2E9EE7E83C4285B;

rax=_lrotl(rax, rax&0xF); // rotate left

r8=rax+rdx;

rdx=0x8888888888888889;

rax=r8;

rax*=rdx;

// RDX here is a high part of multiplication result

rdx=rdx>>5;

// RDX here is division result!

rax=rdx;

rcx=r8+rdx*4;
rax=rax<<6;
rcx=rcx-rax;
rax=r8
rax=_lrotl (rax, rcx&0xFF); // rotate left
return rax;
};

Next step:

uint64_t f(uint64_t input)
{
uint64_t rax, rbx, rcx, rdx, r8;

ecx=input;

rdx=0x5D7E0D1F2E0F1F84;

rax=rcx;

rax*=rdx;