Quick introduction to reverse engineering for beginners
Quick introduction to reverse engineering for beginners
Quick introduction to reverse engineering for beginners
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
sub esp, 10h<br />
; put a and b <strong>to</strong> local stack:<br />
mov eax, [ebp+a_first_half]<br />
mov dword ptr [ebp+a], eax<br />
mov eax, [ebp+a_second_half]<br />
mov dword ptr [ebp+a+4], eax<br />
mov eax, [ebp+b_first_half]<br />
mov dword ptr [ebp+b], eax<br />
mov eax, [ebp+b_second_half]<br />
mov dword ptr [ebp+b+4], eax<br />
; load a and b <strong>to</strong> FPU stack:<br />
fld [ebp+a]<br />
fld [ebp+b]<br />
; current stack state: ST(0) - b; ST(1) - a<br />
fxch st(1) ; this instruction swapping ST(1) and ST(0)<br />
; current stack state: ST(0) - a; ST(1) - b<br />
fucompp ; compare a and b and pop two values from stack, i.e., a and b<br />
fnstsw ax ; s<strong>to</strong>re FPU status <strong>to</strong> AX<br />
sahf ; load SF, ZF, AF, PF, and CF flags state from AH<br />
setnbe al ; s<strong>to</strong>re 1 <strong>to</strong> AL if CF=0 and ZF=0<br />
test al, al ; AL==0 ?<br />
jz short loc_8048453 ; yes<br />
fld [ebp+a]<br />
jmp short locret_8048456<br />
loc_8048453:<br />
fld [ebp+b]<br />
locret_8048456:<br />
leave<br />
retn<br />
d_max endp<br />
FUCOMPP — is almost like FCOM, but popping both values from stack and handling “not-a-numbers” differently.<br />
More about not-a-numbers:<br />
FPU is able <strong>to</strong> work with special values which are not-a-numbers or NaNs 37 . These are infinity, result of<br />
dividing by zero, etc. Not-a-numbers can be “quiet” and “signalling”. It is possible <strong>to</strong> continue <strong>to</strong> work with<br />
“quiet” NaNs, but if one try <strong>to</strong> do some operation with “signalling” NaNs — an exception will be raised.<br />
FCOM will raise exception if any operand — NaN. FUCOM will raise exception only if any operand —<br />
signalling NaN (SNaN).<br />
The following instruction is SAHF — this is rare instruction in the code which is not use FPU. 8 bits from<br />
AH is movin<strong>to</strong> in<strong>to</strong> lower 8 bits of CPU flags in the following order: SF:ZF:-:AF:-:PF:-:CF