出于一些很猥琐的需要,同时自己也想做一些新鲜的尝试,周末用了大半天时间破解了某款手游的数据文件。
过程比我预想的要顺利,主要原因还是我们开发人员的懈怠,咳咳。
过程如下:
.text:002C46E0 EXPORT My_Encrypt_Func
.text:002C46E0 My_Encrypt_Func ; CODE XREF: sqlite3Codec+11Cp
.text:002C46E0 ; sqlite3Codec+190p
.text:002C46E0
.text:002C46E0 var_3C = -0x3C
.text:002C46E0 var_38 = -0x38
.text:002C46E0 var_34 = -0x34
.text:002C46E0 var_30 = -0x30
.text:002C46E0 var_28 = -0x28
.text:002C46E0 var_20 = -0x20
.text:002C46E0 var_4 = -4
.text:002C46E0
.text:002C46E0 STR R11, [SP,#var_4]!
.text:002C46E4 ADD R11, SP, #4+var_4
.text:002C46E8 SUB SP, SP, #0x1C
.text:002C46EC STR R0, [R11,#0x20+var_30]
.text:002C46F0 STR R1, [R11,#0x20+var_34]
.text:002C46F4 STR R2, [R11,#0x20+var_38]
.text:002C46F8 STR R3, [R11,#0x20+var_3C]
.text:002C46FC MOV R3, #0
.text:002C4700 STR R3, [R11,#0x20+var_28]
.text:002C4704 B loc_2C473C
.text:002C4708 ; ---------------------------------------------------------------------------
.text:002C4708
.text:002C4708 loc_2C4708 ; CODE XREF: My_Encrypt_Func+68j
.text:002C4708 LDR R3, [R11,#-0x10]
.text:002C470C LDRB R3, [R3]
.text:002C4710 MVN R3, R3
.text:002C4714 STRB R3, [R11,#-9]
.text:002C4718 LDR R3, [R11,#-0x10]
.text:002C471C LDRB R2, [R11,#-9]
.text:002C4720 STRB R2, [R3]
.text:002C4724 LDR R3, [R11,#-0x10]
.text:002C4728 ADD R3, R3, #1
.text:002C472C STR R3, [R11,#-0x10]
.text:002C4730 LDR R3, [R11,#-8]
.text:002C4734 ADD R3, R3, #1
.text:002C4738 STR R3, [R11,#-8]
.text:002C473C
.text:002C473C loc_2C473C ; CODE XREF: My_Encrypt_Func+24j
.text:002C473C LDR R2, [R11,#-8]
.text:002C4740 LDR R3, [R11,#-0x14]
.text:002C4744 CMP R2, R3
.text:002C4748 BCC loc_2C4708
.text:002C474C MOV R3, #0
.text:002C4750 MOV R0, R3
.text:002C4754 SUB SP, R11, #0
.text:002C4758 LDR R11, [SP+0x20+var_20],#4
.text:002C475C BX LR
.text:002C475C ; End of function My_Encrypt_Func
.text:00001D88 ; My_Encrypt_Func(unsigned char *, unsigned int, unsigned char *, unsigned int)
.text:00001D88 EXPORT _Z15My_Encrypt_FuncPhjS_j
.text:00001D88 _Z15My_Encrypt_FuncPhjS_j
.text:00001D88 MOVS R3, #0
.text:00001D8A B loc_1D94
.text:00001D8C ; ---------------------------------------------------------------------------
.text:00001D8C
.text:00001D8C loc_1D8C ; CODE XREF: My_Encrypt_Func(uchar *,uint,uchar *,uint)+Ej
.text:00001D8C LDRB R2, [R0,R3]
.text:00001D8E MVNS R2, R2
.text:00001D90 STRB R2, [R0,R3]
.text:00001D92 ADDS R3, #1
.text:00001D94
.text:00001D94 loc_1D94 ; CODE XREF: My_Encrypt_Func(uchar *,uint,uchar *,uint)+2j
.text:00001D94 CMP R3, R1
.text:00001D96 BNE loc_1D8C
.text:00001D98 MOVS R0, #0
.text:00001D9A BX LR
.text:00001D9A ; End of function My_Encrypt_Func(uchar *,uint,uchar *,uint)