Reversing : The Hacker's Guide to Reverse Engineering

nonzero, CF will be set to one. It appears that some compilers like to use this additional functionality provided by NEGas a cle ...

call SomeFunc sub eax, 4 neg eax sbb eax, eax and al, -52 add eax, 54 ret You’ll notice that this sequence also uses the NEG/SBB ...

Predicated Execution Using arithmetic sequences to implement branchless logic is a very limited technique. For more elaborate br ...

Without branchless logic, a compiler would have to generate the following code or something very similar to it: cmp [result], 0 ...

loads one of the possible results into ECXand the other into EAX. The code checks EDXagainst the conditional value (zero in this ...

observes which functions are executed most frequently. The program then reorganizes the order of functions in the binary accordi ...

Figure A.13 Effects of function-level working-set tuning on code placement in binary executables. Function1 (Medium Popularity) ...

Figure A.14 The effects of line-level working-set tuning on code placement in the same sample binary executable. Function1 (Medi ...

519 CHAPTER This appendix explains the basics of how arithmetic is implemented in assem- bly language, and demonstrates some bas ...

program code. Many of the flags in EFLAGSare system flags that determine the current state of the processor. Other than these sy ...

The above addition will produce different results, depending on whether the destination operand is treated as signed or unsigned ...

Basic Integer Arithmetic The following section discusses the basic arithmetic operations and how they are implemented by compile ...

Multiplication and Division Before beginning the discussion on multiplication and division, I will discuss a few of the basics. ...

Basically, what you have here is y=x*2*2*2*2*2, which is equivalent to y=x*32. This code, generated by Intel’s compiler, is actu ...

faster than division on IA-32 processors, and in some cases it is possible to avoid the use of division instructions by using mu ...

Table B.1 Examples of Reciprocal Multiplications in Division RECIPROCAL DIVISOR IN 32-BIT VALUE (AS A COMBINED SOURCE CODE RECIP ...

This code multiplies ECXby 0xAAAAAAAB, which is equivalent to 0.6666667 (or two-thirds). It then shifts the number by two positi ...

mov eax, DWORD PTR [Divisor] cdq mov edi, 100 idiv edi This code divides Divisorby 100 and places the result in EDX. This is the ...

Most modern compilers provide built-in support for 64-bit data types. These data types are usually stored as two 32-bit integers ...

called allmulthat is called whenever two 64-bit values are multiplied. This function, along with its assembly language source co ...