Quick introduction to reverse engineering for beginners
Quick introduction to reverse engineering for beginners
Quick introduction to reverse engineering for beginners
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
; current stack state: ST(0) = result of _a divided by 3.13<br />
fld QWORD PTR _b$[ebp]<br />
; current stack state: ST(0) = _b; ST(1) = result of _a divided by 3.13<br />
fmul QWORD PTR __real@4010666666666666<br />
; current stack state: ST(0) = result of _b * 4.1; ST(1) = result of _a divided by 3.13<br />
faddp ST(1), ST(0)<br />
; current stack state: ST(0) = result of addition<br />
pop ebp<br />
ret 0<br />
_f ENDP<br />
FLD takes 8 bytes from stack and load the number in<strong>to</strong> ST(0) register, au<strong>to</strong>matically converting it in<strong>to</strong><br />
internal 80-bit <strong>for</strong>mat extended precision).<br />
FDIV divide value in register ST(0) by number s<strong>to</strong>ring at address __real@40091eb851eb851f — 3.14<br />
value is coded there. Assembler syntax missing floating point numbers, so, what we see here is hexadecimal<br />
representation of 3.14 number in 64-bit IEEE 754 encoded.<br />
After FDIV execution, ST(0) will hold quotient 31 .<br />
By the way, there are also FDIVP instruction, which divide ST(1) by ST(0), popping both these values<br />
from stack and then pushing result. If you know Forth language 32 , you will quickly understand that this is<br />
stack machine 33 .<br />
Next FLD instruction pushing b value in<strong>to</strong> stack.<br />
After that, quotient is placed <strong>to</strong> ST(1), and ST(0) will hold b value.<br />
Next FMUL instruction do multiplication: b from ST(0) register by value at __real@4010666666666666<br />
(4.1 number is there) and leaves result in ST(0).<br />
Very last FADDP instruction adds two values at <strong>to</strong>p of stack, placing result at ST(1) register and then<br />
popping value at ST(1), hereby leaving result at <strong>to</strong>p of stack in ST(0).<br />
The function must return result in ST(0) register, so, after FADDP there are no any other code except of<br />
function epilogue.<br />
GCC 4.4.1 (with -O3 option) emitting the same code, however, slightly different:<br />
public f<br />
f proc near<br />
arg_0 = qword ptr 8<br />
arg_8 = qword ptr 10h<br />
push ebp<br />
fld ds:dbl_8048608 ; 3.14<br />
; stack state now: ST(0) = 3.13<br />
mov ebp, esp<br />
fdivr [ebp+arg_0]<br />
31 division result<br />
32 http://en.wikipedia.org/wiki/Forth_(programming_language)<br />
33 http://en.wikipedia.org/wiki/Stack_machine<br />
38
Change language