Reverse Engineering for Beginners

CHAPTER 49. INCORRECTLY DISASSEMBLED CODE CHAPTER 49. INCORRECTLY DISASSEMBLED CODE

SXTB R7, R4

LDR R4, [R1,#0x4C]

STR R4, [R4,R2]

STR R0, [R6,#0x20]

BGT 0xFFFFFF72

LDRH R7, [R2,#0x34]

LDRSH R0, [R2,R4]

LDRB R2, [R7,R2]

DCB 0x17

DCB 0xED

STRB R3, [R1,R1]

STR R5, [R0,#0x6C]

LDMIA R3, {R0-R5,R7}

ASRS R3, R2, #3

LDR R4, [SP,#0x2C4]

SVC 0xB5

LDR R6, [R1,#0x40]

LDR R5, =0xB2C5CA32

STMIA R6, {R1-R4,R6}

LDR R1, [R3,#0x3C]

STR R1, [R5,#0x60]

BCC 0xFFFFFF70

LDR R4, [SP,#0x1D4]

STR R5, [R5,#0x40]

ORRS R5, R7

loc_3C ; DATA XREF: ROM:00000006
B 0xFFFFFF98

Listing 49.5: random noise (MIPS little endian)

lw $t9, 0xCB3($t5)

sb $t5, 0x3855($t0)

sltiu $a2, $a0, -0x657A

ldr $t4, -0x4D99($a2)

daddi $s0, $s1, 0x50A4

lw $s7, -0x2353($s4)

bgtzl $a1, 0x17C5C

.byte 0x17

.byte 0xED

.byte 0x4B # K

.byte 0x54 # T

lwc2 $31, 0x66C5($sp)

lwu $s1, 0x10D3($a1)

ldr $t6, -0x204B($zero)

lwc1 $f30, 0x4DBE($s2)

daddiu $t1, $s1, 0x6BD9

lwu $s5, -0x2C64($v1)

cop0 0x13D642D

bne $gp, $t4, 0xFFFF9EF0

lh $ra, 0x1819($s1)

sdl $fp, -0x6474($t8)

jal 0x78C0050

ori $v0, $s2, 0xC634

blez $gp, 0xFFFEA9D4

swl $t8, -0x2CD4($s2)

sltiu $a1, $k0, 0x685

sdc1 $f15, 0x5964($at)

sw $s0, -0x19A6($a1)

sltiu $t6, $a3, -0x66AD

lb $t7, -0x4F6($t3)

sd $fp, 0x4B02($a1)

It is also important to keep in mind that cleverly constructed unpacking and decryption code (including self-modifying) may
looks like noise as well, but still execute correctly.