Author Topic: Big math help!  (Read 2079 times)

0 Members and 1 Guest are viewing this topic.

Newby

• Moderator
• Hero Member
• Posts: 10884
• Thrash!
Big math help!
« on: February 09, 2008, 03:53:49 pm »
Ok, so I'm reversing a function (we'll call this function functionA) and here's what it generally looks like:

Code: [Select]
`; introBlockmov     eax, RegCodelea     ecx, [eax+11h]imul    ecx, eax; bblock1mov     eax, 85D858Bhimul    ecxsar     edx, 0Ahmov     eax, edxshr     eax, 1Fhadd     eax, edximul    eax, 7A69hsub     ecx, eaximul    ecx, 1ACFh; bblock2mov     eax, 85DCB87Dhimul    ecxadd     edx, ecxsar     edx, 0Ehmov     eax, edxshr     eax, 1Fhadd     eax, edximul    eax, 7A65hsub     ecx, eaximul    ecx, 1AD7h`
And my C code:

Code: [Select]
`/* Necessary stuff so it makes sense. */typedef unsigned long long int QWORD;typedef unsigned long int DWORD;#define HIDWORD(x) ((DWORD)((x) >> 32))int functionA(int ArgumentOne){        /* introBlock */ QWORD ecx = 0; DWORD edx = 0; DWORD eax = 0; ecx = (ArgumentOne + 0x11) * ArgumentOne;         /* bblock1 */ edx = HIDWORD(0x85D858B * ecx) >> 0x0A; eax = ((edx >> 0x1F) + edx) * 0x7A69; ecx -= eax; ecx *= 0x1ACF;        /* bblock2 */ edx = (HIDWORD(0x85DCB87D * ecx) + ecx) >> 0x0E; eax = ((edx >> 0x1F) + edx) * 0x7A65; ecx -= eax; ecx *= 0x1AD7;//      ...}`
I've taken the liberty of splitting the assembly/C into their respective blocks, which I will label introBlock, bblock1, and bblock2.

Side-by-side, introBlock and bblock1 are identical in output. When we get to bblock2...

Code: [Select]
`edx = (HIDWORD(0x85DCB87D * ecx) + ecx) >> 0x0E;`
...it does not have the same output as this:

Code: [Select]
`mov     eax, 85DCB87Dhimul    ecxadd     edx, ecxsar     edx, 0Eh`
I narrowed the problem down to the imul line. The value the assembly puts on register edx when it does edx:eax = eax * ecx is not the same as what I get when I try to do the same with C. I can get the exact same lower dword, but the upper dword isn't the same.

Anybody care to poke at my work and tell me where I went wrong?

Oh, and if anyone would care to explain the concept behind signed and unsigned arithmetic (not just variables, but like, imul and mul are different -- how?) as I can't wrap my mind around their differences. Thanks sidoh!
« Last Edit: February 09, 2008, 04:15:47 pm by Newby »
- Newby
http://www.x86labs.org

Quote
[17:32:45] * xar sets mode: -oooooooooo algorithm ban chris cipher newby stdio TehUser tnarongi|away vursed warz
[17:32:54] * xar sets mode: +o newby
[17:32:58] <xar> new rule
[17:33:02] <xar> me and newby rule all

I'd bet that you're currently bloated like a water ballon on a hot summer's day.

That analogy doesn't even make sense.  Why would a water balloon be especially bloated on a hot summer's day? For your sake, I hope there wasn't too much logic testing on your LSAT.

Camel

• Hero Member
• Posts: 1705
Re: Big math help!
« Reply #1 on: February 10, 2008, 02:25:28 pm »
You seem to have already solved this, but it's still worth pointing out that your macro is mangled.

<Camel> i said what what
<Blaze> in the butt
<Camel> you want to do it in my butt?
<Blaze> in my butt
<Camel> let's do it in the butt
<Blaze> Okay!

Newby

• Moderator
• Hero Member
• Posts: 10884
• Thrash!
Re: Big math help!
« Reply #2 on: February 10, 2008, 06:07:55 pm »
You seem to have already solved this, but it's still worth pointing out that your macro is mangled.

I have not solved the issue (I simply did inline assembly), and can you point out how?
- Newby
http://www.x86labs.org

Quote
[17:32:45] * xar sets mode: -oooooooooo algorithm ban chris cipher newby stdio TehUser tnarongi|away vursed warz
[17:32:54] * xar sets mode: +o newby
[17:32:58] <xar> new rule
[17:33:02] <xar> me and newby rule all

I'd bet that you're currently bloated like a water ballon on a hot summer's day.

That analogy doesn't even make sense.  Why would a water balloon be especially bloated on a hot summer's day? For your sake, I hope there wasn't too much logic testing on your LSAT.

Camel

• Hero Member
• Posts: 1705
Re: Big math help!
« Reply #3 on: February 11, 2008, 03:55:49 pm »
Nevermind, I miscounted.

<Camel> i said what what
<Blaze> in the butt
<Camel> you want to do it in my butt?
<Blaze> in my butt
<Camel> let's do it in the butt
<Blaze> Okay!