Reverse Engineering for Beginners

CHAPTER 21. STRUCTURES CHAPTER 21. STRUCTURES

MSVC + OllyDbg

Let’s load our example into OllyDbg and see, what values are set in EAX/EBX/ECX/EDX after the execution of CPUID:

Figure 21.6:OllyDbg: After CPUID execution

EAX has0x000206A7(myCPUis Intel Xeon E3-1220).
This is 00000000000000100000011010100111 in binary form.

Here is how the bits are distributed by fields:

field in binary form in decimal form

reserved2 0000 0

extended_family_id 00000000 0

extended_model_id 0010 2

reserved1 00 0

processor_id 00 0

family_id 0110 6

model 1010 10

stepping 0111 7

Figure 21.7:OllyDbg: Result

GCC

Let’s try GCC 4.4.1 with-O3option.

Listing 21.26: Optimizing GCC 4.4.1

main proc near ; DATA XREF: _start+17
push ebp
mov ebp, esp
and esp, 0FFFFFFF0h
push esi