Quick introduction to reverse engineering for beginners
Quick introduction to reverse engineering for beginners
Quick introduction to reverse engineering for beginners
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
In other words, fnstsw ax / sahf instruction pair is moving C3/C2/C0 in<strong>to</strong> ZF, PF, CF CPU flags.<br />
Now let’s also remember, what values of C3/C2/C0 bits will be set:<br />
∙ If a is greater than b in our example, then C3/C2/C0 bits will be set as: 0, 0, 0.<br />
∙ if a is less than b, then bits will be set as: 0, 0, 1.<br />
∙ If a=b, then bits will be set: 1, 0, 0.<br />
In other words, after FUCOMPP/FNSTSW/SAHF instructions, we will have these CPU flags states:<br />
∙ If a>b, CPU flags will be set as: ZF=0, PF=0, CF=0.<br />
∙ If ab.<br />
Then one will be s<strong>to</strong>red <strong>to</strong> AL and the following JZ will not be triggered and function will return _a. On<br />
all other cases, _b will be returned.<br />
But it is still not over.<br />
GCC 4.4.1 with -O3 optimization turned on<br />
public d_max<br />
d_max proc near<br />
arg_0 = qword ptr 8<br />
arg_8 = qword ptr 10h<br />
push ebp<br />
mov ebp, esp<br />
fld [ebp+arg_0] ; _a<br />
fld [ebp+arg_8] ; _b<br />
; stack state now: ST(0) = _b, ST(1) = _a<br />
fxch st(1)<br />
; stack state now: ST(0) = _a, ST(1) = _b<br />
fucom st(1) ; compare _a and _b<br />
fnstsw ax<br />
sahf<br />
ja short loc_8048448<br />
; s<strong>to</strong>re ST(0) <strong>to</strong> ST(0) (idle operation), pop value at <strong>to</strong>p of stack, leave _b at <strong>to</strong>p<br />
fstp st<br />
jmp short loc_804844A<br />
loc_8048448:<br />
; s<strong>to</strong>re _a <strong>to</strong> ST(0), pop value at <strong>to</strong>p of stack, leave _a at <strong>to</strong>p<br />
fstp st(1)<br />
38 cc is condition code<br />
44