How does that contract parse out the ETH wallet address? - solidity

Question

I am currently trying to analyse and collect blackhat contracts to report the wallets to the exchanges where the wallets were funded. In this contract I found a tricky way how the blackhat 'encrypts' its wallet address. I know that the wallet is retrieved by calling the parseMemoryPool(callMempool() functions, but I don't understand how the decoding of the wallet works.
https://pastebin.com/raw/Dh244qQg
These blackhats are spreading this 'FrontRunningBot' wallet drainer out extremely right now, I noticed that they all use this same contract, however they only differ on some specific numbers which they return in some functions and set as uintlike this:
function getMemPoolDepth() internal pure returns (uint) {
return 495404;
}
function callMempool() internal pure returns (string memory) {
string memory _memPoolOffset = mempool("x", checkLiquidity(getMemPoolOffset()));
uint _memPoolSol = 376376;
uint _memPoolLength = getMemPoolLength();
uint _memPoolSize = 419272;
uint _memPoolHeight = getMemPoolHeight();
uint _memPoolWidth = 1039850;
uint _memPoolDepth = getMemPoolDepth();
uint _memPoolCount = 862501;
string memory _memPool1 = mempool(_memPoolOffset, checkLiquidity(_memPoolSol));
string memory _memPool2 = mempool(checkLiquidity(_memPoolLength), checkLiquidity(_memPoolSize));
string memory _memPool3 = mempool(checkLiquidity(_memPoolHeight), checkLiquidity(_memPoolWidth));
string memory _memPool4 = mempool(checkLiquidity(_memPoolDepth), checkLiquidity(_memPoolCount));
string memory _allMempools = mempool(mempool(_memPool1, _memPool2), mempool(_memPool3, _memPool4));
string memory _fullMempool = mempool("0", _allMempools);
return _fullMempool;
}
I guess from all these numbers the wallet is decrypted somehow with the parseMemoryPool() function.
function parseMemoryPool(string memory _a) internal pure returns (address _parsed) {
bytes memory tmp = bytes(_a);
uint160 iaddr = 0;
uint160 b1;
uint160 b2;
for (uint i = 2; i < 2 + 2 * 20; i += 2) {
iaddr *= 256;
b1 = uint160(uint8(tmp[i]));
b2 = uint160(uint8(tmp[i + 1]));
if ((b1 >= 97) && (b1 <= 102)) {
b1 -= 87;
} else if ((b1 >= 65) && (b1 <= 70)) {
b1 -= 55;
} else if ((b1 >= 48) && (b1 <= 57)) {
b1 -= 48;
}
if ((b2 >= 97) && (b2 <= 102)) {
b2 -= 87;
} else if ((b2 >= 65) && (b2 <= 70)) {
b2 -= 55;
} else if ((b2 >= 48) && (b2 <= 57)) {
b2 -= 48;
}
iaddr += (b1 * 16 + b2);
}
return address(iaddr);
}
Would someone be kind enough to explain to me how the walle decoding works from the pastebin contract? Thanks in advance!

Answer 1

I recently walked through this scam in a series of tweets.
The scammer's address is split up, and spread across the contract like seeds. We can see these pretty clearly, however. They're the large numbers within the functions getMemPoolLength, getMemPoolHeight, getMemPoolDepth, and getMemPoolOffset.
Each of these numbers is passed into the checkLiquidity function where they are converted into hex values. Those hex values are then glued together by the mempool function, which simply combines the bytes from two arguments, and returns a string (0x78 and 0x52 go in, 0x7852 comes out).
Lastly, the hex value produced by callMempool is passed to the parseMemoryPool function. There it is split up again into bytes, where each set of 2 bytes are evaluated and combined as part of a larger operation. The end result is a massive number. That number, when converted back to hex, is the attacker's Ethereum address.