Alice Averlong🏳️‍⚧️

I love finding a mysterious NOP in a released binary.

Someone patched this. Compilers don't usually just stick a NOP in the middle of a functional call.

Unless they're MIPS or similar, I guess, but there are very few MS-DOS games that run on MIPS processors

Dec 20, 2024 at 2:58amWeb
Show threadAlice Averlong🏳️‍⚧️Dec 20, 2024

"how do I tell if I've inaccurately marked data as code?"

well, does it ever use the XLAT instruction? then yeah, it's wrong.

Show threadAlice Averlong🏳️‍⚧️Dec 20, 2024

or AAS/DAA/AAD/DAS/AAM.

The chances that the code you're looking at legitimately uses BCD are approximately zero

Show threadlj·rkDec 20, 2024
@foone This should honestly be part of the heuristics Ghidra should use. Plus, war you if you do it by accident. Too many times I had wrongly detected (or previously mistakenly declared as) code sections I had to clean up by squinting my eyes and saying “nah, this aint lookin like legit code”
Show threadAlice Averlong🏳️‍⚧️Dec 20, 2024
@ljrk yeah!
Show threadgloriouscowDec 20, 2024

@foone @ljrk

I remember fravia describing being deep in a disassembly listing as being lost in the "code forest". That always stuck with me.

When I was debugging my emulator, it would often go off the rails, so I quickly got a feel for when the trees looked awfully weird.

Here we are again, back among the mutant trees...

Show threadgloriouscowDec 20, 2024

@foone @ljrk

I wish I could say the chances of BCD were zero. Pretty common for DOS stuff to use it. FAT stores timestamps in BCD.

Nintendo completely disabled BCD in the 6502 of the NES and that was an incredibly based move

Show thread⭐NINIKA⭐️ 🦀Dec 20, 2024
@foone
I think I saw it in early MSVC init code (for windows) though
Show threadRDec 20, 2024
@foone not sure if it ends up getting called, but if you're looking at gizmos and gadgets still, it does contain a legit XLAT
Show threadNewNewDougDec 20, 2024
@foone Alignment?
Show threadAlice Averlong🏳️‍⚧️Dec 20, 2024
@NewNewDoug x86 don't give a shit about alignment, at least pre-SSE
Show threadgloriouscowDec 20, 2024

@foone @NewNewDoug

they care for speed reasons. 8086 will waste a bus cycle reading/fetching from odd addresses, and when we went to a 32-bit data bus with the 386 there were similar penalties for being out of dword alignment.

so seeing a nop before a jump target at an odd address isn't that weird

Show threadnuxiDec 20, 2024

@foone "there are very few MS-DOS games that run on MIPS processors"

Careful. You know people around here are prone to take that as a challenge.

Show threadAlice Averlong🏳️‍⚧️Dec 20, 2024
@nuxi all according to plan
Show threadNiko (lethal_guitar)Dec 20, 2024
@foone I'm pretty sure the Borland compilers do sometimes insert NOPs for alignment under certain circumstances
Show threadAlice Averlong🏳️‍⚧️Dec 20, 2024
@lethal_guitar Dang it. This is Borland C++, so maybe it's not such a tell after all