Skip to content

reimplement: SHC_3BB0A8C1_0x00471830 and support functions 100%#87

Draft
TheRedDaemon wants to merge 2 commits into
mainfrom
reimpl/SHC_3BB0A8C1_0x00471830
Draft

reimplement: SHC_3BB0A8C1_0x00471830 and support functions 100%#87
TheRedDaemon wants to merge 2 commits into
mainfrom
reimpl/SHC_3BB0A8C1_0x00471830

Conversation

@TheRedDaemon
Copy link
Copy Markdown
Contributor

@TheRedDaemon TheRedDaemon commented May 24, 2026

The weird patterns in the copy functions made me use assembly in the end.
Maybe that is the origin, maybe it is not. I found no other way to recreate this pattern.
Is heavily commented.

Also, draft: There needs to be a type change in LowLevelMemory.hpp.

Closes #91 .

@TheRedDaemon TheRedDaemon requested a review from gynt May 24, 2026 16:46
@TheRedDaemon
Copy link
Copy Markdown
Contributor Author

Added logic comments, however, still needs change in class definition of LowLevelMemory.hpp, either confirmed to have happend in Ghidra, or via commit to main.

Copy link
Copy Markdown
Contributor

@gynt gynt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you change the name of file copyData+.hpp to something without the +?
Or split them up again in separate files or does that ruin the match?
I would like to stick to the philosophy of the flie location being locatable just by function name and namespace.

@TheRedDaemon
Copy link
Copy Markdown
Contributor Author

TheRedDaemon commented Jun 1, 2026

I can simplify it again to copyData.hpp, but they need to be in one file (under the assumption that Global Optimization was not used by them). Here my comment:

    // NOTE: The calls to the copyData... functions are optimized in "copyData", which means the compiler knew the
    //   content of these functions. The most likely thing is that these functions shared a file. It does therefore only
    //   work if the resolvers are active.

This may happen to us in other cases, too. At least in any moment Ghidra has issues to reuse the ECX, we have to assume they shared a file, and we have to put them together for the perfect match.

@gynt
Copy link
Copy Markdown
Contributor

gynt commented Jun 3, 2026

I synced the change in .hpp in a1971f3

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[PROJECT] Check methods of "LowLevelMemory" regarding possible older compilers

2 participants