ida icon indicating copy to clipboard operation
ida copied to clipboard

[NOT ISSUE] New numbers for TEA algorithm

Open chirrindul opened this issue 3 years ago • 0 comments

I have analyzed a sample of malware-related code and found two numbers related to the TEA algoritm. Those are the numbers and some URLs where you can see more context:


0xb54cda56 
0x61c88647

https://blog.csdn.net/nxjbill/article/details/78160167 https://stackoverflow.com/questions/38994306/what-is-the-meaning-of-0x61c88647-constant-in-threadlocal-java https://github.com/gp0/cod4stats/blob/master/src/codmpdatadec.c http://machbbs.com/52pojie/28773

Unfortunately I cannot confirm the exact variation of the algorithm that uses these constants.

Here you can see asm source code https://pastebin.com/eLm8bw31

chirrindul avatar Feb 17 '22 17:02 chirrindul