某 so 字符串混淆解密

code:

伪代码:

for (i = 0; i < 0xB; i++) {
    ch =
        v1202[i + 2]
        ^ (i + 1)
        ^ v1202[1]
        ^ 0x0B;

    output[i] = ch;
}

output[11] = 0;

字符串解密:

def decode(enc, index_func, xor_const):
    out = bytearray()

    for i, b in enumerate(enc):
        out.append(b ^ index_func(i) ^ xor_const)

    return out.decode(errors="ignore")

print(decode(
    b"cbrQrlr^mik",
    lambda i: i + 1,
    14 ^ 0xB
))

out="getPropSafe"

text code:

v1202[0] = 1;                       // cipher flag
v1202[1] = 14;                      // xor key
qmemcpy(&v1202[2], "cbrQrlr^mik", 11);// getPropSafe
*(_QWORD *)&v1209[0] = v1119;
v21 = v1120;
v22 = 43470561;
while ( v22 != 1703139737 )
{
  *(_BYTE *)v21 = 0;
  v21 = (size_t *)((char *)v21 + 1);
  if ( v21 == *(size_t **)&v1209[0] )
    v22 = 1703139737;
  else
    v22 = 43470561;
}
*(_QWORD *)v1208 = v1202;
LOBYTE(v1161[0]) = v1202[0];
for ( j = -482054042; ; j = -1477169417 )
{
  while ( 1 )
  {
    while ( j <= -644201365 )
    {
      if ( j > -1383186944 )
      {
        if ( j == -1383186943 )
        {
          *(_QWORD *)&v1206 = v1206 + 1;// index++
        }
        else
        {
          *(_QWORD *)&v1200[0] = &v1206;
          *(_QWORD *)&v1206 = 0;
        }
        j = -644201364;
      }
      else if ( j == -1611158705 )
      {
        v1202[13] = 0;
        v1202[14] = 0;
        **(_BYTE **)v1208 = 0;
        j = 497067201;
      }
      else
      {
        **(_BYTE **)&v1209[0] = v1187;// out[i] = ch
        j = -1383186943;
      }
    }
    if ( j > 497067200 )
      break;
    if ( j == -644201364 )
    {
      if ( (unsigned __int64)v1206 >= 0xB )// break loop
        j = -1611158705;
      else
        j = 1289219465;
    }
    else if ( ((__int64)v1161[0] & 1) != 0 )
    {
      j = -1338378762;
    }
    else
    {
      j = 497067201;
    }
  }
  if ( j != 1289219465 )
    break;
  LOBYTE(v1187) = v1202[v1206 + 2] ^ (v1206 + 1) ^ v1202[1] ^ 0xB;// ch = cipher[i] ^ (i + 1) ^ (xorKey ^ 0xB)
  *(_QWORD *)&v1209[0] = &v1202[v1206 + 2];// out index++, in place modify
}