Breaking Eggs And Making Omelettes

Topics On Multimedia Technology and Reverse Engineering


Archives:

Bizarre ASM Construct Of The Day

March 29th, 2006 by Multimedia Mike

Check out this piece of x86 ASM arcana:

  lea   edx, [edx+1]

What on earth? This appears to be functionally equivalent to:

  inc   edx

So, what, was the compiler/assembler or possibly the original coder just trying to show off with a single overachieving x86 instruction like lea? Actually, a closer analysis of the surrounding ASM instructions may reveal what is happening here:

  cmp   ebx, value
  mov   al, [edx]
  lea   edx, [edx+1]
  mov   [edi], al
  lea   edi, [edi+1]
  jz    address

The conditional branch at the end of the block depends on the flags set by the comparison at the start. Per my understanding, neither mov nor lea modify flags but inc probably would (I can never find a good x86 reference– that includes flag data– when I need one). Why not perform the comparison just before the conditional branch? Mine is not to question why. But I imagine that someone will comment that this is an obscure optimization trick for original Pentium machines or some such.

Posted in Reverse Engineering | 2 Comments »

2 Responses

  1. VAG Says:

    That’s one of absolutely common optimization tricks. Cmp shifted away from jz to minimize cpu’s branching prediction errors.

  2. Multimedia Mike Says:

    I’m so ignorant about optimizations so thanks for filling me in.

    I finally dug around Intel’s site and found the manuals (again). Sure enough, the mov and lea instructions do not modify flags but inc could potentially modify the zero flag (actually, the mov instruction lists the flag states as undefined after the operation).