Advertisement
Guest User

Untitled

a guest
Jan 19th, 2019
78
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 3.54 KB | None | 0 0
  1. I find, genuinely, what you predicate quite interesting, as a matter of fact I have an ingenious example to satisfy yours rigorously and to prove all axiomatic natures of what I'd said in benefit to what you clarified!
  2.  
  3. [quote]
  4. 0x00000000080005c0 <+0>: push rbp
  5. 0x00000000080005c1 <+1>: push rbx
  6. 0x00000000080005c2 <+2>: sub rsp,0x8
  7.  
  8. 0x00000000080005c6 <+6>: mov rbx,QWORD PTR [rsi+0x8]
  9. 0x00000000080005ca <+10>: mov rdi,rbx
  10. 0x00000000080005cd <+13>: call 0x80005a0 <strlen@plt>
  11. 0x00000000080005d2 <+18>: mov rdi,rbx
  12. 0x00000000080005d5 <+21>: add rax,rbx
  13. 0x00000000080005d8 <+24>: jmp 0x80005e9 <main+41>
  14.  
  15. 0x00000000080005da <+26>: nop WORD PTR [rax+rax*1+0x0]
  16. 0x00000000080005e0 <+32>: movsx edx,BYTE PTR [rdi]
  17. 0x00000000080005e3 <+35>: add rdi,0x1
  18. 0x00000000080005e7 <+39>: add ebp,edx
  19.  
  20. 0x00000000080005e9 <+41>: cmp rax,rdi
  21. 0x00000000080005ec <+44>: jne 0x80005e0 <main+32>
  22.  
  23. 0x00000000080005ee <+46>: and ebp,0x1
  24. 0x00000000080005f1 <+49>: je 0x80005ff <main+63>
  25. 0x00000000080005f3 <+51>: lea rdi,[rip+0x1ca] # 0x80007c4
  26. 0x00000000080005fa <+58>: call 0x8000590 <puts@plt>
  27.  
  28. 0x00000000080005ff <+63>: add rsp,0x8
  29. 0x0000000008000603 <+67>: xor eax,eax
  30. 0x0000000008000605 <+69>: pop rbx
  31. 0x0000000008000606 <+70>: pop rbp
  32. 0x0000000008000607 <+71>: ret
  33. [/quote]
  34.  
  35. Thanks to @unrealskill for the original C source-code.
  36.  
  37. I will simplify the response, as I assume that the reader and yourself (obviously) have fluent knowledge in x86-64 assembly, however I will use the Intel-flavoured syntax for the readability nonetheless, however I do support the beauty of AT&T.
  38. {main+0}->{main+2} Function prologue, 8 bytes allocated on the stackframe.
  39. {main+6}->{main+10} `rbx` = `argv[1]`
  40. {main+13} `rax` = `strlen (argv[1])`
  41. {main+18}->{main+24} `rdi` = `argv[1]`, `rax = strlen (argv[1]) + argv[1]`, afterwards unconditional jump to {main+41} which is a condition implying this is a `while` loop.
  42. Let `end = strlen (argv[1]) + argv[1]`
  43. {main+41}->{main+44} `while (end != argv[1])`
  44.  
  45. [code]
  46. size_t end = strlen (argv[1]) + argv[1];
  47. while (end != argv[1])
  48. {
  49. ...
  50. }
  51. ...
  52. [/code]
  53.  
  54. {main+32}->{main+39} moves into `edx` the character at `rdi` which is `argv[1]`, afterwards we increment `rdi` by `1` to go to the next character, and have `ebp` be the accumulator which accumulates the value of each character via `add ebp, edx`, you might wonder why `ebp` isn't zeroed in the `main` function, although it's used? That is due to the fact of the System V ABI which dictates that the EBP register must be zeroed upon calling into the UEP (user entry-point), which is neat as an optimization. Now we can see that we have a variable to accumulate the values, and that our final loop will look like such:
  55.  
  56. [code]
  57. size_t acc = 0;
  58. size_t end = strlen (argv[1]) + argv[1];
  59. while (end != argv[1])
  60. {
  61. acc += argv[1][0];
  62. ++argv[1];
  63. }
  64. [/code]
  65.  
  66. {main+46}->{main+71} We logically AND the `acc`umulator by `1`, and if it's not zero then we `puts ("Success.");`, otherwise we don't, and finally we `return 0;`
  67.  
  68. [code]
  69. #include <stdlib.h>
  70. #include <stdio.h>
  71. #include <string.h>
  72.  
  73. int
  74. main (int argc, char **argv)
  75. {
  76. size_t acc = 0;
  77. size_t end = strlen (argv[1]) + argv[1];
  78. while (end != argv[1])
  79. {
  80. acc += argv[1][0];
  81. ++argv[1];
  82. }
  83. if (acc & 1)
  84. puts ("Success.");
  85. return 0;
  86. }
  87. [/code]
  88.  
  89. Beautiful, dare I say.
  90.  
  91. #humblegang
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement