1

Given a large (~14MB) binary compiled for a X86 64-bit system, what would be the basic steps to go through in order to find the usage of Pi (π) for calculation of a certain parameter (flag)?

I'm rather new at this, and I've tried looking through strings to find different mathematical terms and numbers, and I've also gone over the Functions window, and found names such as _tan, _pow, _sqrt, _sin, etc., but no mention of Pi specifically.

Can anyone recommend another way to approach this? Unfortunately I cannot share the specific binary I am working on.

  • 2
    why do you think it's calculating Pi instead of using a hardcoded value? – Igor Skochinsky Oct 28 at 15:49
2

There's a couple of likely possibilities for how the value of Pi is included in the code -

1) It is calculated using trig functions. e.g.

4.0 * atan( 1.0 )

2) It is stored as a floating-point constant. In hexadecimal representation these could be -

0x40490FDB            // 32-bit floating point
0x400921FB54442D18    // 64-bit floating point

However, you need to be aware of compiler optimisations, including constant folding.

Even if the source code uses my first possibility, the compiler may optimise it to a floating-point constant. (i.e. my 2nd possibility)

Then, if the value Pi is only ever used in contexts where it appears in calculations with other constant values, the compiler may perform that part of any calculations at compile time and include only the result in the object file. e.g.

pi = 4.0 * atan( 1.0 );                   // may become = 3.1415926536..
circumference = 2.0 * pi * radius;        // may become = 6.2831853.. * radius
degrees = radians * 180 / pi;             // may become = radians * 57.2957795..
result = fourier_integral / (2.0 * pi);   // may become = fourier_integral * 0.1591549..

So, in summary, you might not find the value of Pi at all and may have to search for likely related constant values.

  • Thanks, this is very helpful. I will go over the binary again. – Charles Oct 30 at 8:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.