Reverse Engineering for Beginners

CHAPTER 17. FLOATING-POINT UNIT CHAPTER 17. FLOATING-POINT UNIT

17.6.1 x86

Let’s see what we get in (MSVC 2010):

Listing 17.7: MSVC 2010

CONST SEGMENT
real@40400147ae147ae1 DQ 040400147ae147ae1r ; 32.01
real@3ff8a3d70a3d70a4 DQ 03ff8a3d70a3d70a4r ; 1.54
CONST ENDS

_main PROC
push ebp
mov ebp, esp
sub esp, 8 ; allocate space for the first variable
fld QWORD PTR real@3ff8a3d70a3d70a4
fstp QWORD PTR [esp]
sub esp, 8 ; allocate space for the second variable
fld QWORD PTR real@40400147ae147ae1
fstp QWORD PTR [esp]
call _pow
add esp, 8 ; "return back" place of one variable.

; in local stack here 8 bytes still reserved for us.
; result now in ST(0)

fstp QWORD PTR [esp] ; move result from ST(0) to local stack for printf()
push OFFSET $SG2651
call _printf
add esp, 12
xor eax, eax
pop ebp
ret 0
_main ENDP

FLDandFSTPmove variables between the data segment and the FPU stack.pow()^12 takes both values from the stack of
the FPU and returns its result in theST(0)register.printf()takes 8 bytes from the local stack and interprets them as
doubletype variable.

By the way, a pair ofMOVinstructions could be used here for moving values from the memory into the stack, because the
values in memory are stored in IEEE 754 format, and pow() also takes them in this format, so no conversion is necessary.
That’s how it’s done in the next example, for ARM:17.6.2.

17.6.2 ARM + Non-optimizing Xcode 4.6.3 (LLVM) (Thumb-2 mode)

_main

var_C = -0xC

PUSH {R7,LR}

MOV R7, SP

SUB SP, SP, #4

VLDR D16, =32.01

VMOV R0, R1, D16

VLDR D16, =1.54

VMOV R2, R3, D16

BLX _pow

VMOV D16, R0, R1

MOV R0, 0xFC1 ; "32.01 ^ 1.54 = %lf\n"

ADD R0, PC

VMOV R1, R2, D16

BLX _printf

MOVS R1, 0

STR R0, [SP,#0xC+var_C]

MOV R0, R1

ADD SP, SP, #4

POP {R7,PC}

(^12) a standard C function, raises a number to the given power (exponentiation)