23.03.2013 Views

Quick introduction to reverse engineering for beginners

Quick introduction to reverse engineering for beginners

Quick introduction to reverse engineering for beginners

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

sub esp, 10h<br />

; put a and b <strong>to</strong> local stack:<br />

mov eax, [ebp+a_first_half]<br />

mov dword ptr [ebp+a], eax<br />

mov eax, [ebp+a_second_half]<br />

mov dword ptr [ebp+a+4], eax<br />

mov eax, [ebp+b_first_half]<br />

mov dword ptr [ebp+b], eax<br />

mov eax, [ebp+b_second_half]<br />

mov dword ptr [ebp+b+4], eax<br />

; load a and b <strong>to</strong> FPU stack:<br />

fld [ebp+a]<br />

fld [ebp+b]<br />

; current stack state: ST(0) - b; ST(1) - a<br />

fxch st(1) ; this instruction swapping ST(1) and ST(0)<br />

; current stack state: ST(0) - a; ST(1) - b<br />

fucompp ; compare a and b and pop two values from stack, i.e., a and b<br />

fnstsw ax ; s<strong>to</strong>re FPU status <strong>to</strong> AX<br />

sahf ; load SF, ZF, AF, PF, and CF flags state from AH<br />

setnbe al ; s<strong>to</strong>re 1 <strong>to</strong> AL if CF=0 and ZF=0<br />

test al, al ; AL==0 ?<br />

jz short loc_8048453 ; yes<br />

fld [ebp+a]<br />

jmp short locret_8048456<br />

loc_8048453:<br />

fld [ebp+b]<br />

locret_8048456:<br />

leave<br />

retn<br />

d_max endp<br />

FUCOMPP — is almost like FCOM, but popping both values from stack and handling “not-a-numbers” differently.<br />

More about not-a-numbers:<br />

FPU is able <strong>to</strong> work with special values which are not-a-numbers or NaNs 37 . These are infinity, result of<br />

dividing by zero, etc. Not-a-numbers can be “quiet” and “signalling”. It is possible <strong>to</strong> continue <strong>to</strong> work with<br />

“quiet” NaNs, but if one try <strong>to</strong> do some operation with “signalling” NaNs — an exception will be raised.<br />

FCOM will raise exception if any operand — NaN. FUCOM will raise exception only if any operand —<br />

signalling NaN (SNaN).<br />

The following instruction is SAHF — this is rare instruction in the code which is not use FPU. 8 bits from<br />

AH is movin<strong>to</strong> in<strong>to</strong> lower 8 bits of CPU flags in the following order: SF:ZF:-:AF:-:PF:-:CF

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!