4
votes
Accepted
Way to check if two assembly programs (one possibly compiled with optimizations) come from the same C source code?
While you can potentially prove that two pieces of binary code are equivalent (i.e. they produce the same results given the same input), this does not by itself mean that the source code was the same. ...
- 36.4k
3
votes
Accepted
There is something else than a "DllMain" in a module for its initialization?
In case of programs you'd also have to watch out for TLS callbacks. These run prior to the entry point, but I have only ever seen those on .exe files, never on DLLs. Still, Peter Ferrie stated that ...
- 10.9k
2
votes
Explain struct access in assembly?
This is called inlining. strcpy was substituted by mov instructions, because compiler decided that in such way code will run faster.
- 1,840
2
votes
Explain struct access in assembly?
This is manual string assignment. Notice how all DWORDs are composed of printable characters? hit r in IDA to convert the hex values to string characters.
This code seems to be assigning strings into ...
- 11.7k
2
votes
Accepted
What does this magic number do?
although I flagged this question should be closed as duplicate, keeping it has some additional value because of the multiple different magic number values used, redirecting users encountering ...
- 11.7k
2
votes
Can somebody explain this weird alignment/optimisation done when zeroing out a buffer?
You'll find a commented analysis of the assembly code with pseudo-code. What's obvious is that this is 'crappy' compiler generated code used to align local variables to a 4-bytes boundary. Most ...
- 2,663
2
votes
Accepted
Tool to analyze .obj files (not COFF) created with /LTCG
I don't know of any tools that can analyze or disassemble CIL bytecode, but what you can do is to link those files and produce normal machine code. E.g. something like:
LINK 1.obj /force /debug /dll /...
- 36.4k
1
vote
Accepted
Decompilation of CIL code into some high level code - do I need to introduce new variables during data flow analysis?
The problem, as I think you realise, is that you are logically moving the calculation of an expression past the point whereby one of its input values gets changed.
Given your current implementation, I'...
- 2,503
1
vote
ARM multiply compiler optimization
You are on the right lines with integer division.
The first 3 instructions are reasonably clear -
R2 after UMULL is the result of an integer division by 1.875 (= 0x100000000 / 0x88888889)
the ...
- 2,503
1
vote
Explain struct access in assembly?
the optimizations mantras of the answers got me intrigued so i thought i'll check what actual optimizations are being done on the code (OP appears to be beginner and i doubted OP would be capable ...
- 16.3k
Only top scored, non community-wiki answers of a minimum length are eligible