Reading Mirai source: a string comparison trap

Analyst objective

Understand the return convention of a small helper before interpreting its callers. Malware analysis often depends on recognizing ordinary utility functions correctly. A familiar function name can be misleading when its implementation differs from a standard library routine.

This study uses a short, original excerpt from the public Mirai source archive. The linked revision fixes the exact text being discussed, so readers can compare the article with the same file even if the repository changes. The excerpt is a string-comparison loop, not a standalone program.

Source code

The following lines are reproduced without modification from util_strcmp. The earlier part of that function calculates both string lengths and returns FALSE if they differ. At the start of this excerpt, l1 is the shared length and the two pointers refer to the strings being compared.

    while (l1--)
    {
        if (*str1++ != *str2++)
            return FALSE;
    }

    return TRUE;

Read the behavior

The loop compares one pair of bytes per iteration. Each pointer advances after its current byte is read. A mismatch returns false immediately; reaching the end returns true. Combined with the preceding length check, the helper answers whether the two strings are equal.

That return convention matters: standard C strcmp returns zero for equal strings, whereas this helper returns true. Treating this custom function as libc strcmp would reverse the meaning of a caller's conditional branch. When naming functions in a disassembler, record the observed semantics instead of relying only on a resemblance to a familiar API.

Defensive analysis workflow

Locate callers of the helper and record which branch is taken on equality. Identify the compared values from the caller's data flow, then annotate what a match means in that particular context. Keep observations from the source separate from observations confirmed in the binary under investigation: compiler optimization, local changes, or a different variant can alter the implementation.

For a simple desk check, compare the expected outcomes for identical strings, different strings of equal length, and different lengths. These cases clarify the contract without building or executing the malware project.

Detection limits

This loop is generic programming logic. Its presence alone is not a useful malware verdict or a reliable family signature. Use the helper to improve your understanding of control flow, then base detection decisions on independently confirmed behavior and surrounding evidence. An attribution to this source archive does not prove that an arbitrary sample belongs to Mirai.

Reference

Mirai source archive: util.c at the reviewed revision.

Exercise

Predict the result for identical strings, strings with different lengths, and equal-length strings differing in the last byte. Why would assuming libc strcmp semantics invert a conditional?

Check your understanding

Identical strings return true; either mismatch returns false. This helper treats equality as true, whereas libc strcmp represents equality with zero.