{"id":460,"date":"2007-09-19T21:35:17","date_gmt":"2007-09-20T04:35:17","guid":{"rendered":"http:\/\/multimedia.cx\/eggs\/what-re-looks-like\/"},"modified":"2007-09-19T21:35:17","modified_gmt":"2007-09-20T04:35:17","slug":"what-re-looks-like","status":"publish","type":"post","link":"https:\/\/multimedia.cx\/eggs\/what-re-looks-like\/","title":{"rendered":"What RE Looks Like"},"content":{"rendered":"

People ask me what binary reverse engineering is like. It’s tedious, that’s what it is. When it gets right down to it, you just have to concentrate on little (in the sense that they do not do much individually) instructions and carefully trace the bigger picture from huge blocks of these baby steps.<\/p>\n

If you want to see what RE really looks<\/em> like, come inside my notebook. Here are 3 choice pages, illustrating the process I used to figure out one of the inverse transforms that RealVideo 4<\/a> (and 3, for that matter; both H.264 prototypes) employ:<\/p>\n


\n\"RV40
\npage 1<\/a>, page 2<\/a>, page 3<\/a>
\n<\/center><\/p>\n

In this example, I used a lot of back substitution in order to figure out a series of math formulas. This case was greatly simplified by the fact that there were not very many mystery parameters to deal with. However, the property that complicated matters here is that there were few if any straightforward imul (integer multiplication) instructions. Even though multiplication figures heavily into the transform, most multiplications were performed by sequences of additions, bit shifts, and compound add\/shift instructions (lea).<\/p>\n","protected":false},"excerpt":{"rendered":"

People ask me what binary reverse engineering is like. It’s tedious, that’s what it is. When it gets right down to it, you just have to concentrate on little (in the sense that they do not do much individually) instructions and carefully trace the bigger picture from huge blocks of these baby steps. If you […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-460","post","type-post","status-publish","format-standard","hentry","category-reverse-engineering"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t