ida
ida copied to clipboard
[NOT ISSUE] New numbers for TEA algorithm
I have analyzed a sample of malware-related code and found two numbers related to the TEA algoritm. Those are the numbers and some URLs where you can see more context:
0xb54cda56
0x61c88647
https://blog.csdn.net/nxjbill/article/details/78160167 https://stackoverflow.com/questions/38994306/what-is-the-meaning-of-0x61c88647-constant-in-threadlocal-java https://github.com/gp0/cod4stats/blob/master/src/codmpdatadec.c http://machbbs.com/52pojie/28773
Unfortunately I cannot confirm the exact variation of the algorithm that uses these constants.
Here you can see asm source code https://pastebin.com/eLm8bw31