[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: if this is RC4
> One possibility is that the author may have simply decompiled the
> original code...
This might explain the char % 255's in the code. Normally such a
construct is dangerous if the machine/compiler you use uses 2 byte
"chars" and there's the slightest posibility of having your "char"
hold more than 255. I would normally use char & 255, however it
may surprise some of us that some machines can do a MOD faster than
an AND and the compiler used might have exploited that feature.
However, reconstructing C code out of binaries is a pain and I
doubt that you'd see a header file as well as a main .c file...
Anyone have experience with decompilers?