You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This is one of Ghidra's Internal Decompiler Functions.
Ghidra's "Help" section contains some info about these functions (Hit F1 while in the decompiler windows).
For SUB, it says:
SUB41(x,c) - Truncation operation - SUBPIECE
The digit '4' indicates the size of the input operand 'x' in bytes.
The digit '1' indicates the size of the output value in bytes.
The parameter 'x' is the value being truncated.
The parameter 'c' is the number of least significant bytes being truncated. SUB42(0xaabbccdd,1) = 0xbbcc
Extract a contiguous subset of the bytes from 'x'. When 'c' is 0, the operation is a simple integer truncation.
SUB41(x,0) truncates from a 4-byte integer to a 1-byte (char or byte) integer.
SUB42(x,0) truncates from a 4-byte integer to a 2-byte (short) integer.
SUB84(x,4) extracts the high 4 bytes from the 8 byte integer.
https://github.com/Dvd848/CTFs/blob/master/2019_Mossad/Challenge3_files/EncryptSoftware.c
The text was updated successfully, but these errors were encountered: