int secondary_payload_decrypt(int a1, payload_check *a2) {
  int i;
  int v3;
  unsigned int v5;
  void *v6;
  int j;
  int v8;
  void *v9;
  int v10;
  unsigned int v11;
  signed int return_value;

  return_value = 0;
 
  if ( a2->size >= 0x340u )
  {
    v5 = (unsigned int)a2->size >> 2;
    v6 = (void *)a2->encrypted_payload;
    memset(v6, 0, 4 * v5);         /* zero encrypted payload */
    v3 = (int)((char *)v6 + 4 * v5);
    for ( i = a2->size & 3; i; --i )
      *(_BYTE *)v3++ = 0;
      /* copy the decrypted content minus the header (64 bytes) to be further
         decrypted */
      memcpy((void *)a2->encrypted_payload, (const void *)(a2->decrypted_payload + 64),
              a2->size - 576);
      v9 = (void *)a2->decrypted_payload;
      v10 = a2->size;
      v11 = (unsigned int)a2->size >> 2;
      memset(v9, 0, 4 * v11);
      v8 = (int)((char *)v9 + 4 * v11);
      for ( j = v10 & 3; j; --j )
          *(_BYTE *)v8++ = 0;
      a2->size -= 576; 
      /* set the size of the payload to be further decrypted to  
         the original payload size minus the size of the appended digital signature
         (512 bytes) and minus the header (64 bytes) */
      if (check_payload_and_extract_header(a2) )
          return_value = 1;
  }
  return return_value;
}


SOURCE LISTING 17: Secondary payload decryption



 


 







Acknowledements

  This material is based upon work supported through the U.S. Army Research Office under the Cyber-TA Research Grant No. W911NF-06-1- 0316 and by the National Science Foundation, Grant No. CNS-07-16 612. The views expressed in this document are those of the authors and do not necessarily represent the official position of the sponsors.