Skip to content

Commit

Permalink
Merge pull request #914 from TakahiroHaruyama/hc-128_update
Browse files Browse the repository at this point in the history
Update HC-128 (variation used in Winnti malware)
  • Loading branch information
mr-tz authored Sep 16, 2024
2 parents 534ee22 + 4170f3c commit dec3ded
Showing 1 changed file with 6 additions and 2 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -23,5 +23,9 @@ rule:
- number: 0x17 = 23 from line 153, tem0 = rotrFixed((ctx->T[(v)]),23);
- number: 0xA = 10 from line 154, tem1 = rotrFixed((ctx->X[(c)]),10);
- number: 0x8 = 8 from line 155, tem2 = rotrFixed((ctx->X[(b)]),8);
- number: 0x3FC = Compiler optimized size used in ANDs for the 1024 sized buffer
- count(mnemonic(rol)): 48
- or:
- number: 0x3FC = Compiler optimized size used in ANDs for the 1024 sized buffer
- number: 0x3FF = 0x3FF from line 105, ctx->counter1024 = (ctx->counter1024 + 16) & 0x3ff;
- or:
- count(mnemonic(rol)): 48
- count(mnemonic(ror)): 48

0 comments on commit dec3ded

Please sign in to comment.