func_2476e15e57ddb2b4和 上一个版本的func_173e8124cdbdc90d应该是类似的？

在sub_C5E3(DanmakuStructTag*, int, char**, char**)里调用时把key固定成了

a1 1c f6 17 58 34 48 37 24 25

求问有没有动态分析的方法？

静态分析:

str2 = L__ZZ8sub_C5E3P16DanmakuStructTagiPPcS2_E3C_2E_2

str3 = L__ZZ8sub_C5E3P16DanmakuStructTagiPPcS2_E3C_2E_3

func_2476e15e57ddb2b4(key, str2, 32)

func_2476e15e57ddb2b4(key, str3, 32)

AES_decrypt(rid, ebp-33, ebp-66, ebp-166)

//ebp-33: modified str2?

//ebp-66: modified str3?

//ebp-166: size 100 buf, output ptr?

snprintf(v6, 499, "%d%s%lld%s%s", rid, did, tt, "1000", aes_output)

Func_86C8982CCCC5E7A0(rid, v6, len(v6), buf)

md5的K表还是像之前一样ff hh +1 gg ii -1

不知道正确率如何

新东西估计主要在这个EncodeFlashMain::EncodeDataC

cpp的，有个全局的初始化，生成80+1字节的bss seg，然后再根据rid的值用一组4 bytes bss和一个_EncodeFlashMain::DecodeFlashMain_0[0-4][0-9](unsigned char*, int, IDataCache*)函数去算最后的encode，这种函数有50个，反向出来的代码量该有多少……

ptr2fun mapping:

modFunStart:int = CModule.allocFunPtrs(modPkgName,416,4);

_EncodeFlashMain::InitialCache() modFunStart + 0

__GLOBAL__I_EncodeFlashMain::InitialCache():int modFunStart + 4

_EncodeFlashMain::EncodeFlashMain_000(unsigned char*, int, IDataCache*):int modeFunStart + 8

_EncodeFlashMain::DecodeFlashMain_000(unsigned char*, int, IDataCache*) modFunStart + 12

_EncodeFlashMain::EncodeFlashMain_001(unsigned char*, int, IDataCache*):int modFunStart + 16

_EncodeFlashMain::DecodeFlashMain_001(unsigned char*, int, IDataCache*) modFunStart + 20

...

_EncodeFlashMain::EncodeFlashMain_049(unsigned char*, int, IDataCache*):int modFunStart + 400

_EncodeFlashMain::DecodeFlashMain_049(unsigned char*, int, IDataCache*) modFunStart + 404

_EncodeFlashMain::DecodeDataC(unsigned char, unsigned char*, unsigned short):int modFunStart + 408

_EncodeFlashMain::EncodeDataC(unsigned char, unsigned char*, unsigned short):int modFunStart + 412