Any idea what this assembly code is doing?

StackMasher

Well-Known Member
OP
Member
Joined
Nov 29, 2016
Messages
136
Trophies
0
Age
20
XP
370
Country
I'm tired of failing all my programming projects and want to try something new. So I decided to try some reverse engineering. Currently I'm working on the linux version of saints row 4, and I'm stuck on this part (parts cut out, ask if more info needed):
Code:
1000a3b0:   e8 0b cf ff ff           call   100072c0 <SteamAPI_RestartAppIfNecessary@plt> #Checks if steam is open, launches it if not and returns 1 indicating that the app should be closed as steam will reopen it. Returns 0 if the app can continue
1000a3b5:   84 c0                   test   %al,%al # ???
1000a3b7:   0f 85 81 01 00 00       jne    1000a53e <__isinff@plt+0x197e>
From looking around, it seems like this code tests if %al is 0, and jumps if not. But why %al? I'm not super familiar with 32bit x86 calling conventions but according to wikipedia, return codes are passed in %eax
 

tetrabrik

Well-Known Member
Newcomer
Joined
Aug 13, 2017
Messages
67
Trophies
0
Age
39
XP
86
Country
United States
yes it does seem it's testing the al part of the eax register. this would be the lower 8 bits of the eax. eax is composed of: ax (16 bits) ah (8 bits) and al (8 bits). they can be used as one register of 32 bits (eax) or just parts of it (as in this case, al only 8 bits).
my guess is that you're correct, the value represents a boolean inside a conditional statement.
without more context not sure where that value's coming from.
 

Mikemk

Well-Known Member
Member
Joined
Mar 26, 2015
Messages
2,089
Trophies
1
Age
28
XP
3,109
Country
United States
Extending what tetrabrik said:

All general registers and several other follow the same pattern.

In the early days of 8-bit computers, you had registers a, b, c, and d. When 16 bit came around, it kept 8 bit access to each half to make porting old code easier.
32-bit and 64-bit CPUs are backwards compatible, so they still have access. r*x (where * is a/b/c/d) is the full 64-bit register, eax is the lower 32 bits, ax the lower 16 bits. al and ah are the lower and higher half of ax.
 

Mikemk

Well-Known Member
Member
Joined
Mar 26, 2015
Messages
2,089
Trophies
1
Age
28
XP
3,109
Country
United States
Also, you're probably seeing a compiler optimization, it's doubtful that the init code was written in assembly.

--------------------- MERGED ---------------------------

Oh, sorry, didn't notice the date
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • Bunjolio @ Bunjolio:
    our school network and chrome policies block stuff too
  • Bunjolio @ Bunjolio:
    alot of yt to mp3 sites are blocked by light speed for "Security"
  • SylverReZ @ SylverReZ:
    It was easy to bypass some of the restrictions, as one of the admins left a registry key in the administrative shares drive, which allowed me to get around the blocking of some sites.
  • Bunjolio @ Bunjolio:
    tf does tta mean
  • Bunjolio @ Bunjolio:
    yeah this is chrome os
  • Bunjolio @ Bunjolio:
    cant do shit
  • SylverReZ @ SylverReZ:
    @Bunjolio, Wdym 'TTA'?
  • Bunjolio @ Bunjolio:
    that* as in why yt to mp3 sites are blocked for security
  • SylverReZ @ SylverReZ:
    @Bunjolio, Remember when YouTubetoMP3 was a thing back in the 2010s?
  • SylverReZ @ SylverReZ:
    Until YT updated some stuffs and broke the website.
  • Bunjolio @ Bunjolio:
    I was 2 in 2010
  • SylverReZ @ SylverReZ:
    Oh lol
  • Bunjolio @ Bunjolio:
    lol
  • SylverReZ @ SylverReZ:
    This was in the Minecraft-era.
  • AncientBoi @ AncientBoi:
    lol Bun rockin out at 2 :rofl2:
  • BakerMan @ BakerMan:
    same tbh
  • AncientBoi @ AncientBoi:
    ♫ Mama hully gully, Papa hully gully, Baby hully gully too:rofl2:
  • AncientBoi @ AncientBoi:
    Oh god, I really am old. lol
  • Sicklyboy @ Sicklyboy:
    @SylverReZ, sup Sylv!
    +1
  • AncientBoi @ AncientBoi:
    Anyway, I gotta go to the store. L8er guys. Oops, I better put some clothes on :shy::tpi::rofl2:
  • SylverReZ @ SylverReZ:
    @Sicklyboy, Hey there Sickly.
  • SylverReZ @ SylverReZ:
    @AncientBoi, Make sure the cops don't see that.
    hazbeans @ hazbeans: hi