Can this decompiled C function (in IDA) be ported to non-pointer languages (python/java/etc.)?

Question

unsigned int __cdecl EncryptCode::DecryptCodeByXOR(EncryptCode *this, unsigned __int8 *dest, unsigned int *a3)
{
  unsigned int result; // eax
  unsigned int v4; // eax
  unsigned __int8 v5; // bl
  unsigned int v6; // edx
  int v7; // ecx
  unsigned int v8; // esi

  result = *a3;
  if ( dest
    && result >= 8
    && *dest == -86
    && dest[1] == -86
    && dest[2] == -86
    && dest[3] == -86
    && dest[4] == -86
    && dest[5] == -86 )
  {
    if ( dest[6] == -86 || !dest || result <= 4 )
      return result;
  }
  else if ( !dest || result < 5 )
  {
    return result;
  }
  if ( !*dest && !dest[3] && dest[dest[1] + 4] == dest[2] )
  {
    v4 = result - 4;
    *a3 = v4;
    memcpy(dest, dest + 4, v4);
    result = *a3;
    if ( *a3 )
    {
      v5 = *((_BYTE *)this + 16);
      v6 = result % v5;
      v7 = *dest;
      *dest ^= v6;
      result = (unsigned int)a3;
      if ( *a3 >= 2 )
      {
        v8 = 1;
        do
        {
          v6 = (v7 + (unsigned int)(unsigned __int8)v6) % v5;
          v5 = *((_BYTE *)this + 16);
          v7 = dest[v8];
          dest[v8++] = v7 ^ v6;
          result = (unsigned int)a3;
        }
        while ( v8 < *a3 );
      }
    }
  }
  return result;
}

With defined headers (from IDA SDK):

#define __int8  char
typedef unsigned char   uint8;
#define _BYTE  uint8

Thing is, I never had experience with C so all I can do is "read" the code but not write it (most of the part is how to define EncryptCode). Also, using frida I dumped from memory the hex of EncryptCode *this = 09 03 08 0c 0a 04 0d 0b so can I use it as a constant?

You can call C code from Java using Java Native Interface (JNI). See https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaNativeInterface.html — Robert Harvey, Jul 29 '20 at 17:06
And [this post](https://stackoverflow.com/q/145270/102937) explains how to call C from python. Generally, most modern programming languages have some way to call C code. — Robert Harvey, Jul 29 '20 at 17:08
General rule of thumb: Don't translate code between languages. Reimplement behaviour. Even if you can translate code from C to Language X and get the desired behaviour, the translation will be inferior if the code is even moderately complicated. Usually though you get the same thing you get when you directly translate one language to another: A gibbering wreck of [All Your Base-isms](https://en.wikipedia.org/wiki/All_your_base_are_belong_to_us). — user4581301, Jul 29 '20 at 17:19
Your question can be answered with "yes" or "no". Please take the [tour] and read [ask] to avoid that kind of mistake. — Ulrich Eckhardt, Jul 29 '20 at 17:55

score 0 · Answer 1 · answered Jul 29 '20 at 17:12

Some mix of C# and Java, but some code doesn't make sense for me.

public static int DecryptCodeByXor(this,ubyte[] dest,unsigned int[] a3){
  unsigned int result; // eax
  unsigned int v4; // eax
  unsigned __int8 v5; // bl
  unsigned int v6; // edx
  int v7; // ecx
  unsigned int v8; // esi
  result=a3[0];
  if(dest!=null&&result>=8
    &&dest[0]==-86
    && dest[1] == -86
    && dest[2] == -86
    && dest[3] == -86
    && dest[4] == -86
    && dest[5] == -86 ){
      if(dest[6]==-86||dest==null||result <=4){
        return result;
      }
   }else if(dest==null||result <5){
      return result;
   }
   if(dest[0]==0&&dest[3]==0&&dest[dest[1]+4]==dest[2]){
     v4 = result - 4;
    a3[0] = v4;
    memcpy(dest, dest[4], v4);//Copy v4 bytes starting from dest[4] to dest[0..v4]
    result = a3[0];
    if (a3[0]!=0)
    {
      v5 = *((_BYTE *)this + 16);//Some offset into the this object
      v6 = result % v5;
      v7 = dest[0];
      dest[0] ^= v6;
      result = (unsigned int)a3;
      if ( a3[0] >= 2 )
      {
        v8 = 1;
        do
        {
          v6 = (v7 + (unsigned int)(unsigned __int8)v6) % v5;
          v5 = *((_BYTE *)this + 16);//Some offset into the this object
          v7 = dest[v8];
          dest[v8++] = v7 ^ v6;
          result = (unsigned int)a3;
        }
        while ( v8 < a3[0] );
      }
    }
   }
}

Can this decompiled C function (in IDA) be ported to non-pointer languages (python/java/etc.)?

1 Answers1