0

I am trying to reassemble code reversed from an executable using radare2. I have managed to extract the asm and am using nasm for reassembling.

The question is, the code also contains commands like byte ptr [esi],pushal, fucomi st(3) and sqrtps xmm5, xmmword [edx - 1] which I'm unfamiliar with.

I tried assembling with the nasm -felf -o command. However, I'm getting the following errors.

test.asm:68: error: comma, colon, decorator or end of line expected after operand
test.asm:69: error: comma, colon, decorator or end of line expected after operand
test.asm:85: error: comma, colon, decorator or end of line expected after operand
test.asm:133: error: comma, colon, decorator or end of line expected after operand
test.asm:167: error: impossible combination of address sizes
test.asm:167: error: invalid effective address
test.asm:298: error: symbol `pushal' redefined
test.asm:423: error: comma, colon, decorator or end of line expected after operand
test.asm:637: error: comma, colon, decorator or end of line expected after operand
test.asm:802: error: symbol `pushal' redefined

According to this stackoverflow post, the keyword ptr does not exist in nasm and it suggested that the word be removed. Doing that resolved a few errors. Now I have the following errors:

test.asm:68: error: comma, colon, decorator or end of line expected after operand
test.asm:69: error: comma, colon, decorator or end of line expected after operand
test.asm:85: error: comma, colon, decorator or end of line expected after operand
test.asm:133: error: comma, colon, decorator or end of line expected after operand
test.asm:298: error: symbol `pushal' redefined
test.asm:423: error: comma, colon, decorator or end of line expected after operand
test.asm:637: error: comma, colon, decorator or end of line expected after operand
test.asm:802: error: symbol `pushal' redefined

Since I have no idea what pushal and sqrtps mean, I'm reluctant to remove them from the code. Could someone please explain what these commands mean?

Additionally suggestions on how I can get this as a compilable error-free code are also welcome.

EDIT: Following user blabb s suggestion, i replaced pushal with pushad and now I have only 2 errors

test.asm:80: error: comma, colon, decorator or end of line expected after operand
test.asm:127: error: comma, colon, decorator or end of line expected after operand

The 2 lines in question are:

fucomi st(3)
and
sqrtps xmm5, xmmword [edx - 1]

any suggestions as to how to handle this?

EDIT 2: including lines 76-83

pop esi
int3
sti
xor ebx,ebx
fucomi st(0),st(3)
jmp 0x400299
pop es
xor ebx, ebx

and lines 122-132

add cl, bh
iretd
mov dr0, ebx
and eax, ebx
ret
push 0xf
sqrtps xmm5, xmmword [edx - 1]
push ecx
push 0xffffffffffffffff
call dword [ecx + 0x51]
push ecx

EDIT3: Based on user blabb s suggestion and also by referring the NASM docs, I found that NASM does not accept st(0),st(3) and instead it accepts st0,st3. Now only one error left.

test.asm:127: error: comma, colon, decorator or end of line expected after operand

Still did not understand how to handle this.

  • 1
    You mean assemble, not recompile? Usually the term compile refers to a high level language. Nasm is an assembler, not a compiler. – dingo_kinznerhook Mar 29 at 14:29
  • Could you show us lines 79-81 and 126-128? That would make it easier to see what could be causing the problem on adjoining lines. – dingo_kinznerhook Mar 29 at 14:31
  • @dingo_kinznerhook, updated the question with the code lines and changed recompiling to reassembling. – Flipsyde Mar 30 at 2:43
2

SYNONYMS for Instruction ( PUSH ALL DOUBLE WORDS / longs)

pushad intel (masm , yasm , nasm , tasm)
pushal at&t with ( gas )

sqrtps = square root of single precision floating point

if you can use intrinsic use SQRTPS __m128 _mm_sqrt_ps (__m128 a);

it takes the 128bit value in src calculates the square rot of it and places the square root in destination xmmword (128 bit register)

you can always find equivalent syntax for all of these instructions and modify the inconsisitent syntax to suit the tool

a cpp src code that illustrates sqrtps usage

//visual studio declares __m128 as union
// for gcc use _mm_set_xxx intrinsc
#include <stdio.h>
#include <intrin.h>

int main(void) {
    __m128 res;
    res.m128_f32[0]=256.0;
    res.m128_f32[1]=64.0;
    res.m128_f32[2]=16.0;
    res.m128_f32[3]=4.0;
    res = _mm_sqrt_ps (res);
    printf("%f %f %f %f\n",
    res.m128_f32[0],
    res.m128_f32[1],
    res.m128_f32[2],
    res.m128_f32[3]
    );
}

compiled and linked and executed

:\>cl /Zi /W4 /Ox /analyze /nologo sqrtps.cpp /link /nologo  /release
sqrtps.cpp

:\>sqrtps.exe
16.000000 8.000000 4.000000 2.000000

disassembly

:\>cdb -c "uf sqrtps!main;q" sqrtps.exe | grep -i sqrtps.*xmm
01081000 0f510db0e10b01  sqrtps  xmm1,xmmword ptr [sqrtps!_xmm (010be1b0)]

relooking at your query it appears you have some problems in the listing

fucomi iirc takes two operands your query shows only one st(3)

edit
yes it takes two operands the first operand is st0 and is default so your listing probably omitted it (dont take my word check confirm and then change to fucomi st,st(3)

and iirc nasm doesnt understand xmmword i think it needs DQWORD

enter image description here

and i don't think unaligned access like [edi -1] is possible with sse operations

no it was not either unaligned access nor dqword nasm simply doesnt like any decorator or qualifier

this assembles links and behaves properly

:\>ls
test.asm

:\>cat test.asm
section .text
global main
main:
sqrtps xmm0,[edi-1]
ret
:\>nasm -f win32 -o test.obj test.asm

:\>ls
test.asm  test.obj

:\>link test.obj /debug /entry:main /release /nologo

:\>ls
test.asm  test.exe  test.obj  test.pdb

:\>..\ndisasm.exe -p intel -b 32 -e 0x200 -k 6,5000 test.exe
00000000  0F5147FF          sqrtps xmm0,oword [edi-0x1]
00000004  C3                ret
00000005  00                db 0x00
00000006  skipping 0x1388 bytes
  • if you can use intrinsic use SQRTPS __m128 _mm_sqrt_ps (__m128 a); Could you please explain/elaborate this line? – Flipsyde Mar 29 at 13:17
  • i added a c program for intrinsic usage and an asm listing that assembles fine with nasm for sqrtps – blabb Mar 30 at 9:26
  • Tried replacing xmmword with all other options(oword,yword,zword,etc.). Nothing worked. got too many errors like shown below. test.asm:12: warning: register size specification ignored test.asm:64: warning: register size specification ignored test.asm:65: warning: register size specification ignored test.asm:84: warning: register size specification ignored test.asm:89: warning: register size specification ignored test.asm:390: warning: register size specification ignored... What do i write instead of sqrtps xmm5, xmmword [edx - 1]?? – Flipsyde Mar 31 at 13:18
  • did you read or see the nasm program i adder – blabb Mar 31 at 16:10
  • My mistake. I should have mentioned that. As suggested I removed the xmmword qualifier. This gave me another bunch of errors ;test.asm:890: warning: register size specification ignored; test.asm:1005: warning: register size specification ignored ; test.asm:12: error: invalid combination of opcode and operands; test.asm:64: error: invalid combination of opcode and operands ;... . Due to this i assumed that that too failed and went back to original error. – Flipsyde Mar 31 at 16:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.