[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: if this is RC4



> One possibility is that the author may have simply decompiled the
> original code...

This might explain the char % 255's in the code.  Normally such a 
construct is dangerous if the machine/compiler you use uses 2 byte
"chars" and there's the slightest posibility of having your "char"
hold more than 255.  I would normally use char & 255, however it
may surprise some of us that some machines can do a MOD faster than
an AND and the compiler used might have exploited that feature.

However, reconstructing C code out of binaries is a pain and I
doubt that you'd see a header file as well as a main .c file...
Anyone have experience with decompilers?