识别编译后的算术操作参照.pdfVIP

Hannibal509@译 附录二：识别编译后的算术操作 This appendix explains the basics of how arithmetic is implemented in assembly language, and demonstrates some basic arithmetic sequences and what they look like while reversing. Arithmetic is one of the basic pillars that make up any program, along with control flow and data management. Some arithmetic sequences are plain and straightforward to decipher while reversing, but in other cases they can be slightly difficult to read because of the various compiler optimizations performed. 本章介绍基本的算术操作是怎样在汇编语言中实现的一些基础知识，并演示一 些可能在逆向工程中经常遇到的基本的算术操作的实现指令流。算术操作和控 制流、数据管理一起构成了解决任何问题的支柱。在逆向工程中，某些算术操 作指令流的意思是显而易见的，但要解读出另一些经过了编译器优化处理后的 算术操作指令流就显得比较困难了。 This appendix opens with a description of the basic IA-32 flags used for arithmetic and proceeds to demonstrate a variety of arithmetic sequences commonly found in compiler-generated IA-32 assembly language code. 本附录从介绍最基本的 IA-32标志位开始，然后介绍一些算术操作在 IA-32编译 器生成的汇编语言中表现的代码 Arithmetic Flags 算术标志位 To understand the details of how arithmetic and logic are implemented in assembly language, you must fully understand flags and how they ’re used. Flags are used in almost every arithmetic instruction in the instruction set, and to truly understand the meaning of arithmetic sequences in assembly language you must understand the meanings of the individual flags and how they are used by the arithmetic instructions. 为了详细理解算术和逻辑指令是如何在汇编语言中实现的，你应该很好的理解 所有的标志位及其用途。几乎指令集中每一个算术指令都要用到标志位。而且 为了真正理解汇编语言中算术指令流的真正含义，你必须理解每一个标志位及 其是怎样被算术指令使用的。 Flags in IA-32 processors are stored in the EFLAGS register, which is a 32-bit register that is managedby the processor and is rarely accessed directly by program code. Many of the flags in EFLAGS are system flags that determine the current state of the processor. Other than these system flags, there are also eight status flags, which represent the current state of the process