Results 1 to 5 of 5

Thread: Asm help needed: What type of CRC is this?

  1. #1
    morlac
    Guest

    Asm help needed: What type of CRC is this?

    Im trying to figure what type of a CRC this is code generate with no luck, assuming that its a CRC function:

    --------------------------------------
    push esi
    mov edx, [esp+arg_0]
    sub ax, ax
    mov ecx, [esp+arg_4]
    cmp ecx, edx
    jbe short exit
    loop:
    mov si, ax
    shr si, 0Fh
    add ax, ax
    or si, ax
    mov al, [edx]
    and eax, 0FFFF00FFh
    add ax, si
    inc edx
    cmp ecx, edx
    ja short loop
    exit:
    pop esi
    retn 8
    --------------------------------------

    Can anybody help?

    Best regards,
    Morlac
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  2. #2
    Anonymous
    Guest
    It's the summation of m terms (n-1)=(n-1)*2 MOD 65535 + n, where n is the nth term: it looks like a checksum calculation.
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  3. #3
    IcyDee
    Guest
    That eqn. is not right, what about all those OR's and right shifts etc.
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  4. #4
    Anonymous
    Guest
    IcyDee (02-11-2001 04:43):
    That eqn. is not right, what about all those OR's and right shifts etc.
    push esi
    mov edx, [esp+arg_0]<=pointer to the first item
    sub ax, ax <=initialize
    mov ecx, [esp+arg_4]<=pointer to the last item
    cmp ecx, edx
    jbe short exit
    loop:
    mov si, ax
    shr si, 0Fh <=this means:"put 1 in SI if SI signed value
    is negative, 0 if SI is positive"
    add ax, ax <=this means:"multiply current item by two,
    in a 16 bit register"
    or si, ax <=this means:"if last sum result is negative,
    complement the value (set bit 0 to 1
    if ax signed value was negative)"
    mov al, [edx] <=next item in AL
    and eax, 0FFFF00FFh <=mask AH with zeroes
    add ax, si <=sum next item
    inc edx
    cmp ecx, edx <=finished?
    ja short loop
    exit:
    pop esi
    retn 8

    This is the significance of "all those OR's and right shifts etc.". It's sufficient that you write a small program in C that contains a vector of values and the equation:

    item=item*2e535+vector[counter];

    and then put in an Assembler skeleton the assembly routine, and compare the results. In this way "all those OR's and right shifts etc." will become clear.
    Regards
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  5. #5
    morla
    Guest
    Thankx guy. This was a great help.

    Thankx again
    I promise that I have read the FAQ and tried to use the Search to answer my question.

Similar Threads

  1. anyone know what type of hash this is?
    By twisted in forum RCE Cryptographics
    Replies: 2
    Last Post: November 26th, 2010, 04:57
  2. Trojan type infection perhaps?
    By Woodmann in forum Malware Analysis and Unpacking Forum
    Replies: 11
    Last Post: August 24th, 2009, 06:02
  3. new type of hasp ?
    By saber in forum The Newbie Forum
    Replies: 4
    Last Post: May 23rd, 2006, 09:25
  4. new type of clever protection?
    By WoZX in forum Malware Analysis and Unpacking Forum
    Replies: 13
    Last Post: January 28th, 2002, 20:50
  5. What type of VB6 protection is this?
    By Cruise in forum Malware Analysis and Unpacking Forum
    Replies: 2
    Last Post: January 31st, 2001, 19:32

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •