I have the following line of code in a game:

movss xmm0,[eax+000000F0]

It basically loads the float speed of the current speed category into the XMM0 register. I already made a jump to an empty code section to get some more space, because I now want to multiply this speed by a hardcoded value of 2 after it was loaded. Sadly, easy-thinking like this doesn't work:

movss xmm0,[eax+000000F0]
mulss xmm0,2

I can't simply multiply an XMM register with an integer or float immediate. I read that I can only multiply with another XMM register. But then again I can't push and pop an existing XMM register to the stack to abuse it for that operation temporarily.

How would I create such a simple multiplication operation?


1 Answer 1


Although you indeed cannot use mulss with an immediate value like you've pointed out, you are allowed to pass an 32bit offset as mulss's second operand:

Multiplies the low single-precision floating-point value from the source operand (second operand) by the low single-precision floating-point value in the destination operand (first operand), and stores the single-precision floating-point result in the destination operand. The source operand can be an XMM register or a 32-bit memory location. The destination operand is an XMM register. The three high-order double-words of the destination operand remain unchanged.

You could then just point to any offset you control, if code is not relocated. If it is, you could simply use 'lea' if in 64bit mode or do the call $+5 / pop trick in x86.

I'll assume x86 because it makes it a bit more complicated. The patch should look something like the following (this wasn't tested):

    push edx
    call next
    pop edx
    movss xmm0,[eax+000000F0]
    mulss xmm0,[edx+float-next]
    pop edx
    <return to previous location>

    <float as 32bit data>

There might be better solutions, but nothing pops at me.

  • 1
    Ah, I must've skipped the detail I can just multiply it with memory! This is awesome. Thanks! Game running fine now ;)
    – Ray
    Commented Sep 9, 2016 at 21:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.