I came across a small function whose only side effects were to modify the state of some processor flags. When I decompiled this function using the Hex Rays decompiler, I simply got an empty function, which is not useful at all in figuring out what the function does. Instead I had to look up each instruction in the assembly language manual and read the pseudocode to determine the net effect of the function. Is there some tool I can paste assembly instructions into and it will spit out all side effects, including flags? I'm interested in x86.
-
When you say you decompiled it, you mean via Hex-Rays?– Rolf RollesJun 7 '13 at 21:37
-
Yeah I was using IDA and Hex-Rays.– user2142Jun 7 '13 at 21:37
-
1@user2142: best bet is to learn assembly first, get used to that and then proceed to the decompiler, not the other way around.– 0xC0000022L ♦Jun 7 '13 at 21:50
-
I know know assembly I just had to consult the manual because I did not have all the flag side effects memorized– user2142Jun 7 '13 at 22:01
-
@user2142: most concise most general-purpose opcodes can be found on a two side cheat page here.– 0xC0000022L ♦Jun 8 '13 at 14:32
Add a comment
|
Hex-Rays performs liveness analysis and dead code elimination, which in the case of your function, it sounds like it decided everything was dead. I think it's impossible to tell Hex-Rays via __usercall that the return location for some function is in a flag location, so under that assumption, Hex-Rays can't help in this situation.
What you want is a tool that is capable of rendering the intermediate language translation for a given instruction or block of instructions. To that extent, tools such as BitBlaze, BAP, and miasm can help. Also see this link for a language-agnostic interface to BAP.
-
Never heard of this tool, this is exactly what I want. Though I guess I am depending on the fact that they read the Intel manuals carefully and got all the side effects right.– user2142Jun 7 '13 at 22:00
-
1No matter what tool you use, you will depend on a fact such as that. In the case of dynamic analysis, you can at least watch in the debugger to verify that changes are happening in the specified locations. Jun 7 '13 at 22:35
-
2@user2142: To me it sounds a bit odd that someone would rather read an IR and not the original assembly code. May I ask why do you want that?– NirIzrJun 7 '13 at 23:21
-
I'm not really sure I want that. Just asked a question that popped into my head while reversing!– user2142Jun 9 '13 at 23:00