1994-09-17 - Re: if this is RC4

Header Data

From: rarachel@prism.poly.edu (Arsen Ray Arachelian)
To: perry@imsi.com
Message Hash: 1203e6ad079bccfa30032653d0f783985bb95694634c2a1f67ffca649575ecd4
Message ID: <9409171312.AA24429@prism.poly.edu>
Reply To: <9409161318.AA06070@snark.imsi.com>
UTC Datetime: 1994-09-17 13:25:13 UTC
Raw Date: Sat, 17 Sep 94 06:25:13 PDT

Raw message

From: rarachel@prism.poly.edu (Arsen Ray Arachelian)
Date: Sat, 17 Sep 94 06:25:13 PDT
To: perry@imsi.com
Subject: Re: if this is RC4
In-Reply-To: <9409161318.AA06070@snark.imsi.com>
Message-ID: <9409171312.AA24429@prism.poly.edu>
MIME-Version: 1.0
Content-Type: text


> One possibility is that the author may have simply decompiled the
> original code...

This might explain the char % 255's in the code.  Normally such a 
construct is dangerous if the machine/compiler you use uses 2 byte
"chars" and there's the slightest posibility of having your "char"
hold more than 255.  I would normally use char & 255, however it
may surprise some of us that some machines can do a MOD faster than
an AND and the compiler used might have exploited that feature.

However, reconstructing C code out of binaries is a pain and I
doubt that you'd see a header file as well as a main .c file...
Anyone have experience with decompilers?

Thread

• Return to September 1994

• Return to “Carl Ellison <cme@tis.com>”
• Return to ““Ian Farquhar” <ianf@wiley.sydney.sgi.com>”
• Return to “jamesd@netcom.com (James A. Donald)”
• Return to “Jim Gillogly <jim@acm.org>”
• Return to ““Perry E. Metzger” <perry@imsi.com>”

• Return to “rarachel@prism.poly.edu (Arsen Ray Arachelian)”

• 1994-09-15 (Thu, 15 Sep 94 11:59:51 PDT) - if this is RC4 - Carl Ellison <cme@tis.com>
  • 1994-09-15 (Thu, 15 Sep 94 12:06:52 PDT) - Re: if this is RC4 - “Perry E. Metzger” <perry@imsi.com>
    • 1994-09-16 (Thu, 15 Sep 94 18:25:33 PDT) - Re: if this is RC4 - “Ian Farquhar” <ianf@wiley.sydney.sgi.com>
      • 1994-09-16 (Fri, 16 Sep 94 06:18:41 PDT) - Re: if this is RC4 - “Perry E. Metzger” <perry@imsi.com>
        • 1994-09-16 (Fri, 16 Sep 94 07:55:18 PDT) - Re: if this is RC4 - jamesd@netcom.com (James A. Donald)
          • 1994-09-16 (Fri, 16 Sep 94 07:57:20 PDT) - Re: if this is RC4 - “Perry E. Metzger” <perry@imsi.com>
          • 1994-09-19 (Sun, 18 Sep 94 22:04:52 PDT) - Re: if this is RC4 - “Ian Farquhar” <ianf@wiley.sydney.sgi.com>
        • 1994-09-17 (Sat, 17 Sep 94 06:25:13 PDT) - Re: if this is RC4 - rarachel@prism.poly.edu (Arsen Ray Arachelian)
          • 1994-09-17 (Sat, 17 Sep 94 09:44:38 PDT) - Re: if this is RC4 - Jim Gillogly <jim@acm.org>