Reverse Engineering for Beginners

(avery) #1

APPENDIX A. X86 APPENDIX A. X86


This branch of cryptography is fast-paced and very politically charged. Most designs are secret; a
majority of military encryptions systems in use today are based on LFSRs. In fact, most Cray computers
(Cray 1, Cray X-MP, Cray Y-MP) have a rather curious instruction generally known as “population count.”
It counts the 1 bits in a register and can be used both to efficiently calculate the Hamming distance
between two binary words and to implement a vectorized version of a LFSR. I’ve heard this called the
canonical NSA instruction, demanded by almost all computer contracts.

[Sch94]

POPFrestore flags from the stack (AKAEFLAGS register)


PUSHA(M) pushes the values of the (R|E)AX, (R|E)CX, (R|E)DX, (R|E)BX, (R|E)BP, (R|E)SI, (R|E)DI registers to the stack.


PUSHFpush flags (AKAEFLAGS register)


RCL(M) rotate left via CF flag:


7 6 5 4 3 2 1 0 CF

CF 7 6 5 4 3 2 1 0

RCR(M) rotate right via CF flag:


CF 7 6 5 4 3 2 1 0

7 6 5 4 3 2 1 0 CF

ROL/ROR(M) cyclic shift


ROL: rotate left:

7 6 5 4 3 2 1 0

CF 7 6 5 4 3 2 1 0

ROR: rotate right:

7 6 5 4 3 2 1 0

7 6 5 4 3 2 1 0 CF

Despite the fact that almost allCPUs have these instructions, there are no corresponding operations in C/C++, so the
compilers of thesePLs usually do not generate these instructions.

For the programmer’s convenience, at leastMSVChas the pseudofunctions (compiler intrinsics)_rotl()and_rotr()^8 , which
are translated by the compiler directly to these instructions.

SALArithmetic shift left, synonymous toSHL


SARArithmetic shift right


7 6 5 4 3 2 1 0

7 6 5 4 3 2 1 0 CF

Hence, the sign bit always stays at the place of theMSB.

SETccop: load 1 to operand (byte only) if the condition is true or zero otherwise. The condition codes are the same as in
the Jcc instructions (A.6.2 on page 886).


STC(M) set CF flag


(^8) MSDN

Free download pdf