From 2b01ae3d94accafffb8bbdaacb5980ef35e408f3 Mon Sep 17 00:00:00 2001 From: DosX Date: Tue, 7 May 2024 11:32:59 +0300 Subject: [PATCH] Update? Update! +virtualization --- tests/disasm-security-audit/TinySnake_after.c | 278 ++++++++++ .../disasm-security-audit/TinySnake_before.c | 485 ++++++++++++++++++ .../{ => legacy_tests}/ASM/after_x64.asm | 0 .../{ => legacy_tests}/ASM/after_x86.asm | 0 .../{ => legacy_tests}/ASM/before_x64.asm | 0 .../{ => legacy_tests}/ASM/before_x86.asm | 0 .../{ => legacy_tests}/C/after_x64.c | 0 .../{ => legacy_tests}/C/after_x86.c | 0 .../{ => legacy_tests}/C/before_x64.c | 0 .../{ => legacy_tests}/C/before_x86.c | 0 .../{ => legacy_tests}/example.c | 0 11 files changed, 763 insertions(+) create mode 100644 tests/disasm-security-audit/TinySnake_after.c create mode 100644 tests/disasm-security-audit/TinySnake_before.c rename tests/disasm-security-audit/{ => legacy_tests}/ASM/after_x64.asm (100%) rename tests/disasm-security-audit/{ => legacy_tests}/ASM/after_x86.asm (100%) rename tests/disasm-security-audit/{ => legacy_tests}/ASM/before_x64.asm (100%) rename tests/disasm-security-audit/{ => legacy_tests}/ASM/before_x86.asm (100%) rename tests/disasm-security-audit/{ => legacy_tests}/C/after_x64.c (100%) rename tests/disasm-security-audit/{ => legacy_tests}/C/after_x86.c (100%) rename tests/disasm-security-audit/{ => legacy_tests}/C/before_x64.c (100%) rename tests/disasm-security-audit/{ => legacy_tests}/C/before_x86.c (100%) rename tests/disasm-security-audit/{ => legacy_tests}/example.c (100%) diff --git a/tests/disasm-security-audit/TinySnake_after.c b/tests/disasm-security-audit/TinySnake_after.c new file mode 100644 index 0000000..1171025 --- /dev/null +++ b/tests/disasm-security-audit/TinySnake_after.c @@ -0,0 +1,278 @@ +/* This file was generated by the Hex-Rays decompiler version 8.3.0.230608. + Copyright (c) 2007-2021 Hex-Rays + + Detected compiler: Visual C++ +*/ + +#include +#include + + +//------------------------------------------------------------------------- +// Function declarations + +_DWORD sub_402800(); // weak +_DWORD sub_402FC9(); // weak +void sub_403021(); +int sub_403039(); +_DWORD sub_4032DB(); // weak +_DWORD sub_4033FF(); // weak +_DWORD sub_403B9D(); // weak +_DWORD sub_403DDE(); // weak +_DWORD sub_404206(); // weak +_DWORD sub_404326(); // weak +_DWORD sub_404446(); // weak +_DWORD sub_404566(); // weak +_DWORD sub_40479F(); // weak +_DWORD sub_405726(); // weak +_DWORD sub_405E13(); // weak +_DWORD sub_405F3E(); // weak +_DWORD sub_40608C(); // weak +_DWORD sub_406360(); // weak +_DWORD sub_40648F(); // weak +_DWORD sub_4065C2(); // weak +_DWORD sub_4066E9(); // weak +_DWORD sub_40682A(); // weak +_DWORD sub_406951(); // weak +_DWORD sub_406A7C(); // weak +_DWORD sub_406BA3(); // weak +int sub_406BFB(); +BOOL sub_406CB8(); +int __cdecl sub_40D752(char *Buffer, size_t BufferCount, char *Format, va_list ArgList); // idb +// int __usercall sub_40D778@(int a1@, int a2@, __int32 a3@); +// int __usercall sub_40D7A4@(int a1@); +// int __usercall sub_40D7A8@(int a1@); +// __time32_t __cdecl time(__time32_t *const Time); +// void __cdecl srand(unsigned int Seed); +// void *__cdecl memmove(void *, const void *Src, size_t Size); +// BOOL __stdcall SetConsoleCursorPosition(HANDLE hConsoleOutput, COORD dwCursorPosition); +// int __cdecl vsnprintf(char *const Buffer, const size_t BufferCount, const char *const Format, va_list ArgList); +void sub_44F05E(); +_DWORD __cdecl sub_44F9BF(_DWORD); // weak + +//------------------------------------------------------------------------- +// Data declarations + +_UNKNOWN loc_4012A8; // weak +_UNKNOWN loc_402EFA; // weak +_UNKNOWN loc_4046D0; // weak +_UNKNOWN loc_405AFC; // weak +int dword_40E09C = 0; // weak +int dword_40E0A0 = 0; // weak +int dword_40E0A4 = 0; // weak +int dword_40E0A8 = 0; // weak +HANDLE hConsoleOutput = NULL; // idb +int dword_40E50C = 0; // weak +int dword_42E50C; // weak +char byte_44F054 = '\0'; // weak +char byte_44F057 = '\x03'; // weak +char byte_44F059 = '\x05'; // weak +char byte_44F05C = '\b'; // weak +_UNKNOWN loc_44F12E; // weak +_UNKNOWN loc_44F19C; // weak + + +//----- (00402800) -------------------------------------------------------- +#error "40280C: cannot convert to microcode (funcsize=6)" + +//----- (00402FC9) -------------------------------------------------------- +#error "402FD5: cannot convert to microcode (funcsize=6)" + +//----- (00403021) -------------------------------------------------------- +void sub_403021() +{ + JUMPOUT(0x403034); +} +// 40302D: control flows out of bounds to 403034 + +//----- (00403039) -------------------------------------------------------- +int sub_403039() +{ + int result; // eax + + do + { + result = 697; + if ( (unsigned int)byte_44F054 >= 0x2B9 ) + break; + result = byte_44F05C; + if ( byte_44F05C <= byte_44F057 ) + break; + result = ((int (*)(void))loc_44F12E)(); + if ( !result ) + break; + result = ((int (__cdecl *)(int, int))loc_44F19C)(31, 1); + if ( !result ) + break; + result = byte_44F059; + } + while ( byte_44F059 ); + return result; +} +// 44F054: using guessed type char byte_44F054; +// 44F057: using guessed type char byte_44F057; +// 44F059: using guessed type char byte_44F059; +// 44F05C: using guessed type char byte_44F05C; + +//----- (004032DB) -------------------------------------------------------- +#error "4032E7: cannot convert to microcode (funcsize=6)" + +//----- (004033FF) -------------------------------------------------------- +#error "40340B: cannot convert to microcode (funcsize=6)" + +//----- (00403B9D) -------------------------------------------------------- +#error "403BA9: cannot convert to microcode (funcsize=6)" + +//----- (00403DDE) -------------------------------------------------------- +#error "403DEA: cannot convert to microcode (funcsize=6)" + +//----- (00404206) -------------------------------------------------------- +#error "404212: cannot convert to microcode (funcsize=6)" + +//----- (00404326) -------------------------------------------------------- +#error "404332: cannot convert to microcode (funcsize=6)" + +//----- (00404446) -------------------------------------------------------- +#error "404452: cannot convert to microcode (funcsize=6)" + +//----- (00404566) -------------------------------------------------------- +#error "404572: cannot convert to microcode (funcsize=6)" + +//----- (0040479F) -------------------------------------------------------- +#error "4047AB: cannot convert to microcode (funcsize=6)" + +//----- (00405726) -------------------------------------------------------- +#error "405732: cannot convert to microcode (funcsize=6)" + +//----- (00405E13) -------------------------------------------------------- +#error "405E1F: cannot convert to microcode (funcsize=6)" + +//----- (00405F3E) -------------------------------------------------------- +#error "405F4A: cannot convert to microcode (funcsize=6)" + +//----- (0040608C) -------------------------------------------------------- +#error "406098: cannot convert to microcode (funcsize=6)" + +//----- (00406360) -------------------------------------------------------- +#error "40636C: cannot convert to microcode (funcsize=6)" + +//----- (0040648F) -------------------------------------------------------- +#error "40649B: cannot convert to microcode (funcsize=6)" + +//----- (004065C2) -------------------------------------------------------- +#error "4065CE: cannot convert to microcode (funcsize=6)" + +//----- (004066E9) -------------------------------------------------------- +#error "4066F5: cannot convert to microcode (funcsize=6)" + +//----- (0040682A) -------------------------------------------------------- +#error "406836: cannot convert to microcode (funcsize=6)" + +//----- (00406951) -------------------------------------------------------- +#error "40695D: cannot convert to microcode (funcsize=6)" + +//----- (00406A7C) -------------------------------------------------------- +#error "406A88: cannot convert to microcode (funcsize=6)" + +//----- (00406BA3) -------------------------------------------------------- +#error "406BAF: cannot convert to microcode (funcsize=6)" + +//----- (00406BFB) -------------------------------------------------------- +int sub_406BFB() +{ + unsigned int v0; // eax + int v1; // eax + int v2; // eax + int v3; // eax + int v4; // eax + int (__cdecl *v5)(_DWORD); // eax + int result; // eax + int v7; // [esp+4h] [ebp-Ch] + int (*v8)(void); // [esp+8h] [ebp-8h] + int v9; // [esp+Ch] [ebp-4h] + + dword_40E50C = 12; + dword_42E50C = 12; + v0 = time(0); + srand(v0); + v1 = ((int (*)(void))loc_4046D0)(); + v9 = ((int (__cdecl *)(int))loc_402EFA)(v1); + v2 = ((int (*)(void))loc_405AFC)(); + v8 = (int (*)(void))((int (__stdcall *)(int, int))loc_4012A8)(v9, v2); + dword_40E09C = v8() % 23 + 1; + v3 = ((int (*)(void))loc_4046D0)(); + v7 = ((int (__cdecl *)(int))loc_402EFA)(v3); + v4 = ((int (*)(void))loc_405AFC)(); + v5 = (int (__cdecl *)(_DWORD))((int (__stdcall *)(int, int))loc_4012A8)(v7, v4); + dword_40E0A0 = v5(v5) % 23 + 1; + dword_40E0A4 = 0; + result = 1; + dword_40E0A8 = 1; + return result; +} +// 40E09C: using guessed type int dword_40E09C; +// 40E0A0: using guessed type int dword_40E0A0; +// 40E0A4: using guessed type int dword_40E0A4; +// 40E0A8: using guessed type int dword_40E0A8; +// 40E50C: using guessed type int dword_40E50C; +// 42E50C: using guessed type int dword_42E50C; + +//----- (00406CB8) -------------------------------------------------------- +BOOL sub_406CB8() +{ + COORD v1; // [esp-4h] [ebp-8h] BYREF + __int16 Src[2]; // [esp+0h] [ebp-4h] BYREF + + Src[0] = 0; + Src[1] = 2; + memmove(&v1, Src, 4u); + return SetConsoleCursorPosition(hConsoleOutput, v1); +} + +//----- (0040D752) -------------------------------------------------------- +int __cdecl sub_40D752(char *Buffer, size_t BufferCount, char *Format, va_list ArgList) +{ + return vsnprintf(Buffer, BufferCount, Format, ArgList); +} + +//----- (0040D778) -------------------------------------------------------- +int __usercall sub_40D778@(int a1@, int a2@, __int32 a3@) +{ + void **v3; // ecx + int (__thiscall *v6)(int); // [esp-4h] [ebp-4h] + void *retaddr; // [esp+0h] [ebp+0h] BYREF + + v6 = (int (__thiscall *)(int))_InterlockedExchange((volatile __int32 *)&retaddr, a3); + v3 = &retaddr; + do + { + v3 -= 1024; + a1 -= 4096; + } + while ( a1 >= 4096 ); + return v6(a2); +} + +//----- (0040D7A4) -------------------------------------------------------- +int __usercall sub_40D7A4@(int a1@) +{ + return *(_DWORD *)(a1 - 20); +} + +//----- (0040D7A8) -------------------------------------------------------- +int __usercall sub_40D7A8@(int a1@) +{ + return **(_DWORD **)sub_40D7A4(a1); +} + +//----- (0044F05E) -------------------------------------------------------- +void sub_44F05E() +{ + ; +} + +//----- (0044F9BF) -------------------------------------------------------- +#error "44FC98: cannot convert to microcode (funcsize=70)" + +// nfuncs=71 queued=33 decompiled=33 lumina nreq=0 worse=0 better=0 +#error "There were 24 decompilation failure(s) on 33 function(s)" diff --git a/tests/disasm-security-audit/TinySnake_before.c b/tests/disasm-security-audit/TinySnake_before.c new file mode 100644 index 0000000..26aa256 --- /dev/null +++ b/tests/disasm-security-audit/TinySnake_before.c @@ -0,0 +1,485 @@ +/* This file was generated by the Hex-Rays decompiler version 8.3.0.230608. + Copyright (c) 2007-2021 Hex-Rays + + Detected compiler: Visual C++ +*/ + +#include +#include + + +//------------------------------------------------------------------------- +// Function declarations + +int sub_401000(); +BOOL sub_401077(); +BOOL __cdecl sub_4010BC(char *Format, WORD a2); +int sub_401110(); +int sub_40137B(); +int sub_401471(); +// int __usercall sub_4017E5@(int a1@); +void __noreturn start(); // weak +// int __usercall sub_401AFC@(int a1@, int a2@, __int32 a3@); +// int __usercall sub_401B28@(int a1@); +// int __usercall sub_401B2C@(int a1@); +int __cdecl sub_401B6D(_DWORD *a1, char a2); +// __time32_t __cdecl time(__time32_t *const Time); +// void __cdecl srand(unsigned int Seed); +// int __cdecl rand(); +// void *__cdecl memmove(void *, const void *Src, size_t Size); +// BOOL __stdcall SetConsoleCursorPosition(HANDLE hConsoleOutput, COORD dwCursorPosition); +// BOOL __stdcall GetConsoleScreenBufferInfo(HANDLE hConsoleOutput, PCONSOLE_SCREEN_BUFFER_INFO lpConsoleScreenBufferInfo); +// BOOL __stdcall SetConsoleTextAttribute(HANDLE hConsoleOutput, WORD wAttributes); +// int printf(const char *const Format, ...); +// int __cdecl kbhit(); +// int __cdecl getch(); +// int __cdecl tolower(int C); +// int sprintf(char *const Buffer, const char *const Format, ...); +// BOOL __stdcall SetConsoleTitleA(LPCSTR lpConsoleTitle); +// HANDLE __stdcall GetStdHandle(DWORD nStdHandle); +// BOOL __stdcall SetConsoleWindowInfo(HANDLE hConsoleOutput, BOOL bAbsolute, const SMALL_RECT *lpConsoleWindow); +// BOOL __stdcall SetConsoleScreenBufferSize(HANDLE hConsoleOutput, COORD dwSize); +// void *__cdecl memset(void *, int Val, size_t Size); +// BOOL __stdcall SetConsoleCursorInfo(HANDLE hConsoleOutput, const CONSOLE_CURSOR_INFO *lpConsoleCursorInfo); +// void __stdcall Sleep(DWORD dwMilliseconds); +// void __cdecl _set_app_type(_crt_app_type Type); +// unsigned int __cdecl controlfp(unsigned int NewValue, unsigned int Mask); +// int __cdecl _getmainargs(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD); weak +// void __cdecl __noreturn exit(int Code); + +//------------------------------------------------------------------------- +// Data declarations + +int dword_401B5C[3] = { -1, 4201270, 4201291 }; // weak +_UNKNOWN j__except_handler3; // weak +int dword_402000 = 0; // weak +int dword_402004 = 0; // weak +int dword_402008 = 1; // weak +int dword_40200C = 0; // weak +int dword_402010 = 0; // weak +int dword_402014 = 0; // weak +int dword_402018 = 0; // weak +HANDLE hConsoleOutput = NULL; // idb +char asc_402020[3] = " "; // idb +_UNKNOWN unk_402023; // weak +char aOo[3] = "oO"; // idb +char asc_402029[3] = " "; // idb +char asc_40202C[3] = "##"; // idb +char aScore[] = "SCORE"; // idb +char asc_402098[] = "==============\n="; // idb +char aGameOver[] = " GAME OVER! "; // idb +char asc_4020B6[] = "=\n=============="; // idb +// extern int _argc; +// extern char **_argv; +// extern char **environ; +int dword_4023C8[32768] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, }; // weak +int dword_4223C8[32768]; // weak +struct _CONSOLE_SCREEN_BUFFER_INFO ConsoleScreenBufferInfo; // idb +int dword_4423E0; // weak + + +//----- (00401000) -------------------------------------------------------- +int sub_401000() +{ + unsigned int v0; // eax + int result; // eax + + dword_4023C8[0] = 12; + dword_4223C8[0] = 12; + v0 = time(0); + srand(v0); + dword_40200C = rand() % 23 + 1; + dword_402010 = rand() % 23 + 1; + dword_402014 = 0; + result = 1; + dword_402018 = 1; + return result; +} +// 40200C: using guessed type int dword_40200C; +// 402010: using guessed type int dword_402010; +// 402014: using guessed type int dword_402014; +// 402018: using guessed type int dword_402018; +// 4023C8: using guessed type int dword_4023C8[32768]; +// 4223C8: using guessed type int dword_4223C8[32768]; + +//----- (00401077) -------------------------------------------------------- +BOOL sub_401077() +{ + COORD v1; // [esp-4h] [ebp-8h] BYREF + __int16 Src[2]; // [esp+0h] [ebp-4h] BYREF + + Src[0] = 0; + Src[1] = 2; + memmove(&v1, Src, 4u); + return SetConsoleCursorPosition(hConsoleOutput, v1); +} + +//----- (004010BC) -------------------------------------------------------- +BOOL __cdecl sub_4010BC(char *Format, WORD a2) +{ + GetConsoleScreenBufferInfo(hConsoleOutput, &ConsoleScreenBufferInfo); + SetConsoleTextAttribute(hConsoleOutput, a2); + printf(Format); + return SetConsoleTextAttribute(hConsoleOutput, ConsoleScreenBufferInfo.wAttributes); +} + +//----- (00401110) -------------------------------------------------------- +int sub_401110() +{ + int v0; // eax + char *v1; // eax + int k; // [esp+0h] [ebp-10h] + int v4; // [esp+4h] [ebp-Ch] + int j; // [esp+8h] [ebp-8h] + int i; // [esp+Ch] [ebp-4h] + + sub_401077(); + for ( i = 0; i < 25; ++i ) + { + for ( j = 0; j < 25; ++j ) + { + if ( i && i != 24 && j && j != 24 ) + { + if ( i == dword_4223C8[0] && j == dword_4023C8[0] ) + { + if ( dword_402000 ) + v1 = aOo; + else + v1 = (char *)&unk_402023; + sub_4010BC(v1, 112); + } + else if ( i == dword_402010 && j == dword_40200C ) + { + sub_4010BC(asc_402029, 192); + } + else + { + v4 = 0; + for ( k = 1; k < dword_402008; ++k ) + { + if ( dword_4023C8[k] == j && dword_4223C8[k] == i ) + { + sub_4010BC(asc_40202C, 136); + v4 = 1; + break; + } + } + if ( !v4 ) + printf(" "); + } + } + else + { + if ( dword_402000 ) + v0 = 64; + else + v0 = 48; + sub_4010BC(asc_402020, v0); + } + } + printf("\n"); + } + sub_4010BC(aScore, 96); + return printf(": %d\n", dword_402004); +} +// 401077: using guessed type int sub_401077(void); +// 402000: using guessed type int dword_402000; +// 402004: using guessed type int dword_402004; +// 402008: using guessed type int dword_402008; +// 40200C: using guessed type int dword_40200C; +// 402010: using guessed type int dword_402010; +// 4023C8: using guessed type int dword_4023C8[32768]; +// 4223C8: using guessed type int dword_4223C8[32768]; + +//----- (0040137B) -------------------------------------------------------- +int sub_40137B() +{ + int result; // eax + int v1; // eax + + result = kbhit(); + if ( result ) + { + v1 = getch(); + result = tolower(v1); + switch ( result ) + { + case 'a': + result = dword_402014; + if ( dword_402014 != 1 ) + { + dword_402014 = -1; + result = 0; + dword_402018 = 0; + } + break; + case 'd': + result = dword_402014; + if ( dword_402014 != -1 ) + { + dword_402014 = 1; + result = 0; + dword_402018 = 0; + } + break; + case 's': + result = dword_402018; + if ( dword_402018 != -1 ) + { + dword_402014 = 0; + result = 1; + dword_402018 = 1; + } + break; + case 'w': + result = dword_402018; + if ( dword_402018 != 1 ) + { + dword_402014 = 0; + result = -1; + dword_402018 = -1; + } + break; + } + } + return result; +} +// 402014: using guessed type int dword_402014; +// 402018: using guessed type int dword_402018; + +//----- (00401471) -------------------------------------------------------- +int sub_401471() +{ + int result; // eax + int m; // [esp+0h] [ebp-24h] + int k; // [esp+4h] [ebp-20h] + int j; // [esp+8h] [ebp-1Ch] + int v4; // [esp+Ch] [ebp-18h] + int i; // [esp+10h] [ebp-14h] + int v6; // [esp+14h] [ebp-10h] + int v7; // [esp+18h] [ebp-Ch] + int v8; // [esp+1Ch] [ebp-8h] + int v9; // [esp+20h] [ebp-4h] + + v9 = dword_4023C8[0]; + v8 = dword_4223C8[0]; + dword_4023C8[0] += dword_402014; + dword_4223C8[0] += dword_402018; + if ( dword_4023C8[0] ) + { + if ( dword_4023C8[0] == 24 ) + dword_4023C8[0] = 1; + } + else + { + dword_4023C8[0] = 23; + } + if ( dword_4223C8[0] ) + { + if ( dword_4223C8[0] == 24 ) + dword_4223C8[0] = 1; + } + else + { + dword_4223C8[0] = 23; + } + for ( i = 1; i < dword_402008; ++i ) + { + v7 = dword_4023C8[i]; + v6 = dword_4223C8[i]; + dword_4023C8[i] = v9; + dword_4223C8[i] = v8; + v9 = v7; + v8 = v6; + } + if ( dword_4023C8[0] == dword_40200C && dword_4223C8[0] == dword_402010 ) + { + do + { + dword_40200C = rand() % 23 + 1; + dword_402010 = rand() % 23 + 1; + } + while ( dword_40200C == dword_4023C8[0] && dword_402010 == dword_4223C8[0] ); + v4 = 1; + for ( j = 1; j < dword_402008; ++j ) + { + if ( dword_40200C == dword_4023C8[j] && dword_402010 == dword_4223C8[j] ) + { + v4 = 1; + break; + } + } +LABEL_22: + while ( v4 ) + { + dword_40200C = rand() % 23 + 1; + dword_402010 = rand() % 23 + 1; + v4 = 0; + for ( k = 0; k < dword_402008; ++k ) + { + if ( dword_40200C == dword_4023C8[k] && dword_402010 == dword_4223C8[k] ) + { + v4 = 1; + goto LABEL_22; + } + } + } + dword_402004 += 10; + ++dword_402008; + } + for ( m = 1; ; ++m ) + { + result = m; + if ( m >= dword_402008 ) + break; + if ( dword_4023C8[m] == dword_4023C8[0] && dword_4223C8[m] == dword_4223C8[0] ) + { + result = 1; + dword_402000 = 1; + return result; + } + } + return result; +} +// 402000: using guessed type int dword_402000; +// 402004: using guessed type int dword_402004; +// 402008: using guessed type int dword_402008; +// 40200C: using guessed type int dword_40200C; +// 402010: using guessed type int dword_402010; +// 402014: using guessed type int dword_402014; +// 402018: using guessed type int dword_402018; +// 4023C8: using guessed type int dword_4023C8[32768]; +// 4223C8: using guessed type int dword_4223C8[32768]; + +//----- (004017E5) -------------------------------------------------------- +// positive sp value has been detected, the output may be wrong! +int __usercall sub_4017E5@(int a1@) +{ + int v1; // eax + int result; // eax + COORD v3; // [esp-8h] [ebp-8h] BYREF + + sub_401AFC(); + sprintf((char *const)(a1 - 0x8000), "Tiny Snake (x%d)", 32); + SetConsoleTitleA((LPCSTR)(a1 - 0x8000)); + *(_DWORD *)(a1 - 32776) = 51; + *(_DWORD *)(a1 - 32772) = 33; + hConsoleOutput = GetStdHandle(0xFFFFFFF5); + *(_WORD *)(a1 - 32784) = 0; + *(_WORD *)(a1 - 32782) = 0; + *(_WORD *)(a1 - 32780) = *(_DWORD *)(a1 - 32776) - 1; + *(_WORD *)(a1 - 32778) = *(_DWORD *)(a1 - 32772) - 1; + SetConsoleWindowInfo(hConsoleOutput, 1, (const SMALL_RECT *)(a1 - 32784)); + *(_WORD *)(a1 - 32788) = *(_WORD *)(a1 - 32776); + *(_WORD *)(a1 - 32786) = *(_WORD *)(a1 - 32772); + memmove(&v3, (const void *)(a1 - 32788), 4u); + SetConsoleScreenBufferSize(hConsoleOutput, v3); + *(_DWORD *)(a1 - 32796) = 0; + memset((void *)(a1 - 32792), 0, 4u); + *(_DWORD *)(a1 - 32796) = 1; + *(_DWORD *)(a1 - 32792) = 0; + SetConsoleCursorInfo(hConsoleOutput, (const CONSOLE_CURSOR_INFO *)(a1 - 32796)); + printf("Coded by DosX-dev (GitHub)\nUSE ONLY ENGLISH KEYBOARD LAYOUT! (WASD)\n"); + sub_401000(); + while ( !dword_402000 ) + { + sub_401110(); + sub_40137B(); + sub_401471(); + Sleep(0x64u); + } + dword_402014 = 0; + dword_402018 = 0; + sub_401110(); + printf("\n"); + sub_4010BC(asc_402098, 68); + sub_4010BC(aGameOver, 116); + sub_4010BC(asc_4020B6, 68); + printf("\nPress X to exit"); + do + { + v1 = getch(); + result = tolower(v1); + } + while ( result != 120 ); + return result; +} +// 4019F4: positive sp value 4 has been found +// 401000: using guessed type _DWORD sub_401000(); +// 401110: using guessed type _DWORD sub_401110(); +// 40137B: using guessed type _DWORD sub_40137B(); +// 401471: using guessed type _DWORD sub_401471(); +// 401AFC: using guessed type _DWORD sub_401AFC(); +// 402000: using guessed type int dword_402000; +// 402014: using guessed type int dword_402014; +// 402018: using guessed type int dword_402018; + +//----- (004019F8) -------------------------------------------------------- +void __noreturn start() +{ + int v0; // eax + int v1; // [esp+8h] [ebp-1Ch] BYREF + char v2[24]; // [esp+Ch] [ebp-18h] BYREF + + sub_401B6D(v2); + v1 = 0; + _set_app_type(_crt_console_app); + controlfp(0x10000u, 0x30000u); + _getmainargs(_argc, _argv, environ, dword_4423E0, &v1); + v0 = sub_4017E5(_argc, _argv, environ); + exit(v0); +} +// 4017E5: using guessed type int __cdecl sub_4017E5(_DWORD, _DWORD, _DWORD); +// 4019F8: using guessed type void __noreturn start(); +// 401C50: using guessed type int __cdecl _getmainargs(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD); +// 4423E0: using guessed type int dword_4423E0; +// 4019F8: using guessed type char var_18[24]; + +//----- (00401AFC) -------------------------------------------------------- +int __usercall sub_401AFC@(int a1@, int a2@, __int32 a3@) +{ + void **v3; // ecx + int (__thiscall *v6)(int); // [esp-4h] [ebp-4h] + void *retaddr; // [esp+0h] [ebp+0h] BYREF + + v6 = (int (__thiscall *)(int))_InterlockedExchange((volatile __int32 *)&retaddr, a3); + v3 = &retaddr; + do + { + v3 -= 1024; + a1 -= 4096; + } + while ( a1 >= 4096 ); + return v6(a2); +} + +//----- (00401B28) -------------------------------------------------------- +int __usercall sub_401B28@(int a1@) +{ + return *(_DWORD *)(a1 - 20); +} + +//----- (00401B2C) -------------------------------------------------------- +int __usercall sub_401B2C@(int a1@) +{ + return **(_DWORD **)sub_401B28(a1); +} + +//----- (00401B6D) -------------------------------------------------------- +int __cdecl sub_401B6D(_DWORD *a1, char a2) +{ + int result; // eax + + *a1 = &a2; + a1[1] = 0; + a1[2] = NtCurrentTeb()->NtTib.ExceptionList; + a1[3] = &sub_401B68; + a1[4] = dword_401B5C; + result = 0; + a1[5] = 0; + return result; +} +// 401B5C: using guessed type int dword_401B5C[3]; + +// nfuncs=39 queued=12 decompiled=12 lumina nreq=0 worse=0 better=0 +// ALL OK, 12 function(s) have been successfully decompiled diff --git a/tests/disasm-security-audit/ASM/after_x64.asm b/tests/disasm-security-audit/legacy_tests/ASM/after_x64.asm similarity index 100% rename from tests/disasm-security-audit/ASM/after_x64.asm rename to tests/disasm-security-audit/legacy_tests/ASM/after_x64.asm diff --git a/tests/disasm-security-audit/ASM/after_x86.asm b/tests/disasm-security-audit/legacy_tests/ASM/after_x86.asm similarity index 100% rename from tests/disasm-security-audit/ASM/after_x86.asm rename to tests/disasm-security-audit/legacy_tests/ASM/after_x86.asm diff --git a/tests/disasm-security-audit/ASM/before_x64.asm b/tests/disasm-security-audit/legacy_tests/ASM/before_x64.asm similarity index 100% rename from tests/disasm-security-audit/ASM/before_x64.asm rename to tests/disasm-security-audit/legacy_tests/ASM/before_x64.asm diff --git a/tests/disasm-security-audit/ASM/before_x86.asm b/tests/disasm-security-audit/legacy_tests/ASM/before_x86.asm similarity index 100% rename from tests/disasm-security-audit/ASM/before_x86.asm rename to tests/disasm-security-audit/legacy_tests/ASM/before_x86.asm diff --git a/tests/disasm-security-audit/C/after_x64.c b/tests/disasm-security-audit/legacy_tests/C/after_x64.c similarity index 100% rename from tests/disasm-security-audit/C/after_x64.c rename to tests/disasm-security-audit/legacy_tests/C/after_x64.c diff --git a/tests/disasm-security-audit/C/after_x86.c b/tests/disasm-security-audit/legacy_tests/C/after_x86.c similarity index 100% rename from tests/disasm-security-audit/C/after_x86.c rename to tests/disasm-security-audit/legacy_tests/C/after_x86.c diff --git a/tests/disasm-security-audit/C/before_x64.c b/tests/disasm-security-audit/legacy_tests/C/before_x64.c similarity index 100% rename from tests/disasm-security-audit/C/before_x64.c rename to tests/disasm-security-audit/legacy_tests/C/before_x64.c diff --git a/tests/disasm-security-audit/C/before_x86.c b/tests/disasm-security-audit/legacy_tests/C/before_x86.c similarity index 100% rename from tests/disasm-security-audit/C/before_x86.c rename to tests/disasm-security-audit/legacy_tests/C/before_x86.c diff --git a/tests/disasm-security-audit/example.c b/tests/disasm-security-audit/legacy_tests/example.c similarity index 100% rename from tests/disasm-security-audit/example.c rename to tests/disasm-security-audit/legacy_tests/example.c