Assembly Language for Beginners

8.13. DEMOS There is a cool demo available athttp://go.yurichev.com/17309, which shows visually how the point moves on the plane ...

8.13. DEMOS Then we’ve clicked outside the yellow area and saw a much more chaotic point movement, which quickly went off bounds ...

8.13. DEMOS Let’s get back to the demo The demo, although very tiny (just 64 bytes or 30 instructions), implements the common al ...

8.13. DEMOS 63 ; correct scale: 64 sar bx,6 ; BX=BX/64 65 add bx,dx ; BX=BX+start_X 66 ; now temp_X = temp_X^2 - temp_Y^2 + star ...

8.13. DEMOS Indeed, weuse16-bitregisters, whichholdsignedvaluesintherangeof-32768..32767, soifany of the coordinates is greater ...

8.13. DEMOS 32 xor bx,bx 33 xor si,si 34 35 MandelLoop: 36 mov bp,si 37 imul si,bx 38 add si,si 39 imul bx,bx 40 jo MandelBreak ...

8.14 Other examples. Figure 8.20:My “fixed” version 8.14 Other examples An example about Z3 and manual decompilation was here. I ...

Chapter 9 9 Examples of reversing proprietary file formats file formats 9.1 Primitive XOR-encryption. 9.1.1 Simplest ever XOR en ...

9.1. PRIMITIVE XOR-ENCRYPTION Result: CBA@GFEDKJIHONML It’s like “@” and “C” characters has been swapped, and so are “B” and “a” ...

9.1. PRIMITIVE XOR-ENCRYPTION 9.1.2 Norton Guide: simplest possible 1-byte XOR encryption Norton Guide^1 was popular in the epoc ...

9.1. PRIMITIVE XOR-ENCRYPTION Since the 0x1A byte occurs so often, we can try to decrypt the file, assuming that it’s encrypted ...

9.1. PRIMITIVE XOR-ENCRYPTION Listing 9.1: Wolfram Mathematica 10 In[1]:= input = BinaryReadList["X86.NG"]; In[2]:= Entropy[2, i ...

9.1. PRIMITIVE XOR-ENCRYPTION 9.1.3 Simplest possible 4-byte XOR encryption If a longer pattern was used for XOR-encryption, for ...

9.1. PRIMITIVE XOR-ENCRYPTION Here it is “encrypted” with a 4-byte key: Figure 9.5:“Encrypted” file It’s very easy to spot the r ...

9.1. PRIMITIVE XOR-ENCRYPTION Here is the beginning of a PE-header in hexadecimal form: Figure 9.6:PE-header ...

9.1. PRIMITIVE XOR-ENCRYPTION Here it is “encrypted”: Figure 9.7:“Encrypted” PE-header It’s easy to spot that the key is the fol ...

9.1. PRIMITIVE XOR-ENCRYPTION 9.1.4 Simple encryption using XOR mask. I’ve found an old interactive fiction game while diving de ...

9.1. PRIMITIVE XOR-ENCRYPTION 0000080: 6a 09 61 0d 63 0f 77 14 69 75 62 67 76 01 7e 1d j.a.c.w.iubgv.~. 0000090: 61 7a 11 0f 72 ...

9.1. PRIMITIVE XOR-ENCRYPTION 29, 97, 122, 17, 15, 114, 110, 3, 5, 125, 125, 99, 126, 119, 102, 30, 122, 2, 117}, 1}, {{80, 1, 7 ...

9.1. PRIMITIVE XOR-ENCRYPTION "B", "I", "T", "T", "E", "R", " ", "F", "R", "U", "I", "T", "?", \ " ", " ", " ", " ", " ", " ", " ...