{"id":473,"date":"2007-10-31T21:14:12","date_gmt":"2007-11-01T04:14:12","guid":{"rendered":"http:\/\/multimedia.cx\/eggs\/barretts-basic-blocks-are-back\/"},"modified":"2007-10-31T21:14:12","modified_gmt":"2007-11-01T04:14:12","slug":"barretts-basic-blocks-are-back","status":"publish","type":"post","link":"https:\/\/multimedia.cx\/eggs\/barretts-basic-blocks-are-back\/","title":{"rendered":"Barrett’s Basic Blocks Are Back"},"content":{"rendered":"

Thanks to Sean Barrett<\/a> for helping me compile his bb86 app. I let it rip on this code snippet from the Unnamed RE Project<\/a>. It’s interesting stuff. I omitted the push, pop, and ret instructions since basic blocks pertain to linear sequences of load, store, and arithmetic instructions:<\/p>\n

\r\n$ .\/bb86 < ~\/basic-block.asm\r\nReading stdin\r\nWarning: unknown opcode 'bswap' in line 9\r\n\r\nMemory locations:\r\n        mem1 EQU dword+(ebp_0)+08\r\n        mem5 EQU dword+(mem4)+((mem3 >> 03))\r\n        mem4 EQU dword+(mem1)+10\r\n        mem3 EQU dword+(mem1)+04\r\n        mem2 EQU dword+(ebp_0)+0c\r\n\r\nInteger registers:\r\n  eax = ((mem5 < < cl_0) >> cl_0)\r\n  ebx = mem4\r\n  ecx = (00000020 - mem2)\r\n  edx = (mem3 >> 03)\r\n  esi = mem2\r\n  edi = mem1\r\n\r\nFloating point stack:\r\n  st(0) = fp3\r\n  st(1) = fp2\r\n  st(2) = fp1\r\n  st(3) = fp0\r\n\r\nMemory locations:\r\n  [dword+(mem1)+04] < = (mem3 + mem2)\r\n<\/pre>\n
I am pretty sure that all of those register states are true at the end of the block, though they are listed in the traditional sequence rather than the logical order. I.e., cl needs to be set before eax could be correct.<\/p>\n
I tried out bb86 on a basic block of floating point instructions (using a computation I understand, like the distance between 2 points, rather than a Fourier transform), and it was less than successful (crash). But I can not fault the program since I am feeding it data disassembled by objdump (-Mintel) rather than Microsoft's official format. Again, bb86 is an interesting effort, and I was impressed when I examined the output of test.asm that was packaged with the code (seen in Sean's original comment<\/a>).<\/p>\n","protected":false},"excerpt":{"rendered":"
Thanks to Sean Barrett for helping me compile his bb86 app. I let it rip on this code snippet from the Unnamed RE Project. It’s interesting stuff. I omitted the push, pop, and ret instructions since basic blocks pertain to linear sequences of load, store, and arithmetic instructions: $ .\/bb86 < ~\/basic-block.asm Reading stdin Warning: […]\n<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[54,46,277,47],"class_list":["post-473","post","type-post","status-publish","format-standard","hentry","category-reverse-engineering","tag-decompilation","tag-intel-x86","tag-reverse-engineering","tag-sean-barrett"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t