3

I came across a small function whose only side effects were to modify the state of some processor flags. When I decompiled this function using the Hex Rays decompiler, I simply got an empty function, which is not useful at all in figuring out what the function does. Instead I had to look up each instruction in the assembly language manual and read the pseudocode to determine the net effect of the function. Is there some tool I can paste assembly instructions into and it will spit out all side effects, including flags? I'm interested in x86.

| improve this question | |
  • When you say you decompiled it, you mean via Hex-Rays? – Rolf Rolles Jun 7 '13 at 21:37
  • Yeah I was using IDA and Hex-Rays. – user2142 Jun 7 '13 at 21:37
  • 1
    @user2142: best bet is to learn assembly first, get used to that and then proceed to the decompiler, not the other way around. – 0xC0000022L♦ Jun 7 '13 at 21:50
  • I know know assembly I just had to consult the manual because I did not have all the flag side effects memorized – user2142 Jun 7 '13 at 22:01
  • @user2142: most concise most general-purpose opcodes can be found on a two side cheat page here. – 0xC0000022L♦ Jun 8 '13 at 14:32
5

Hex-Rays performs liveness analysis and dead code elimination, which in the case of your function, it sounds like it decided everything was dead. I think it's impossible to tell Hex-Rays via __usercall that the return location for some function is in a flag location, so under that assumption, Hex-Rays can't help in this situation.

What you want is a tool that is capable of rendering the intermediate language translation for a given instruction or block of instructions. To that extent, tools such as BitBlaze, BAP, and miasm can help. Also see this link for a language-agnostic interface to BAP.

| improve this answer | |
  • Never heard of this tool, this is exactly what I want. Though I guess I am depending on the fact that they read the Intel manuals carefully and got all the side effects right. – user2142 Jun 7 '13 at 22:00
  • 1
    No matter what tool you use, you will depend on a fact such as that. In the case of dynamic analysis, you can at least watch in the debugger to verify that changes are happening in the specified locations. – Rolf Rolles Jun 7 '13 at 22:35
  • 2
    @user2142: To me it sounds a bit odd that someone would rather read an IR and not the original assembly code. May I ask why do you want that? – NirIzr Jun 7 '13 at 23:21
  • I'm not really sure I want that. Just asked a question that popped into my head while reversing! – user2142 Jun 9 '13 at 23:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.