Proposals / #1337

Mac SHA1_Final: void __cdecl (uint8_t* pHashOut, uint* pShaCtx)

checked · by KierTaylor · submitted 2026-11-06

[EBP+0xc] -> EDI is the SHA-1 context: its bit-count words at +0x14/+0x18 are serialised big-endian into a local buffer, and it is passed as [ESP] to the SHA1 update routine 0x002f75f5 for the 0x80 pad, the zero pad and the length. [EBP+8] is the digest output. The caller SRP_InitializeRandomState 0x002f8c34 stores [ESP]=LEA [pSrp+0xc] and [ESP+4]=EBX. Roles and order match the Windows twin 0x0052a040 (void; pHashOut ECX, pShaCtx EDX), on the stack on Mac.

Changes 1, applied together

1. Set prototype mac 0x002f8917

   signatureundefined SHA1_Final(void)→void SHA1_Final(uint8_t* pHashOut, uint* pShaCtx)
   conventionunknown→__cdecl