Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse engineering the Intel FSP: A Primer

puri.sm

Post reply on HN
Print view View original

11–16 of 16 posts

Re: Reverse engineering the Intel FSP: A Primer

#11

Post by userbinator »

I found the odd mix of GNU/AT&T and Intel syntax a little disorienting --- especially all the '%', which the author starts out using in the text but then decides to just suddenly stop using halfway through.

The flowchart view is extremely useful, and from my experience of having taught an Asm class before, in which students were required to do both compilation and decompilation, creating such a graphical representation of the program flow really helps to clarify when going from C to Asm and vice-versa. Lacking software to do it automatically, printing out the code and drawing lines works reasonably well.

That "challenge" function should puzzle anyone who knows even the slightest bit of Asm --- not because of its purpose, but because of how it does it. Subtracting one number and then adding another, is entirely equivalent to adding their sum; so that could be simplified to:

    call $+5
    pop eax
    sub eax, 5
    sub eax, [eax-15]
    ret
The "call $+5/pop" idiom for "where am I" is also used a lot in packers, so those who have such experience with unpacking will recognise it too. Look at enough Asm (particularly compiler output, but I doubt that example was generated by one) and you'll start to pick up on small inefficiencies/stupidities like this; it really tends to dampen your belief in how optimising compilers actually are in practice. ;-)

Re: Reverse engineering the Intel FSP: A Primer

#12

Post by jlgaddis »

comex wrote: post #10

Just for reference, here is what the Hex-Rays decompiler produces for the function in question: https://ghostbin.com/paste/jpeh5 Not as readable or semantically meaningful as the author's manually decompiled version, but pretty decent. So if you think x86 assembly sounds really arcane, you should know that you're not strictly required to learn it to start experimenting with reverse engineering: you can start with a d…

> ... you should know that you're not strictly required to learn it to start experimenting with reverse engineering ...

+1. The only assembly I ever learned was some 6502 assembly many, many years ago, and I didn't even learn that very well. But that didn't prevent me from later figuring out how to "crack" a bunch of BBS door games (with SoftICE for DOS) as a teenager. Hell, I'm not even a real programmer, and I was successful in bypassing the license protections on a (Linux) binary from Cisco a few years ago (although, ultimately, that was just NOP'ing out a "jump") using IDA Pro. That took me maybe 30 minutes to do. Thanks, +Fravia! [0]

I am very far from an expert on this stuff but I think that getting started is waaaay easier than people believe.

(N.B.: IDA Pro runs on Windows but even works on (Linux) ELF binaries.)

[0]: https://en.wikipedia.org/wiki/Fravia

Re: Reverse engineering the Intel FSP: A Primer

#13

Post by jcranmer »

jlgaddis wrote: post #12
comex wrote: post #10

Just for reference, here is what the Hex-Rays decompiler produces for the function in question: https://ghostbin.com/paste/jpeh5 Not as readable or semantically meaningful as the author's manually decompiled version, but pretty decent. So if you think x86 assembly sounds really arcane, you should know that you're not strictly required to learn it to start experimenting with reverse engineering: you can start with a d…

> ... you should know that you're not strictly required to learn it to start experimenting with reverse engineering ... +1. The only assembly I ever learned was some 6502 assembly many, many years ago, and I didn't even learn that very well. But that didn't prevent me from later figuring out how to "crack" a bunch of BBS door games (with SoftICE for DOS) as a teenager. Hell, I'm not even a real programmer, and I was…

The newest versions of IDA Pro run on Linux and OS X as well.

Re: Reverse engineering the Intel FSP: A Primer

#14

Post by cure »

jlgaddis wrote: post #12
comex wrote: post #10

Just for reference, here is what the Hex-Rays decompiler produces for the function in question: https://ghostbin.com/paste/jpeh5 Not as readable or semantically meaningful as the author's manually decompiled version, but pretty decent. So if you think x86 assembly sounds really arcane, you should know that you're not strictly required to learn it to start experimenting with reverse engineering: you can start with a d…

> ... you should know that you're not strictly required to learn it to start experimenting with reverse engineering ... +1. The only assembly I ever learned was some 6502 assembly many, many years ago, and I didn't even learn that very well. But that didn't prevent me from later figuring out how to "crack" a bunch of BBS door games (with SoftICE for DOS) as a teenager. Hell, I'm not even a real programmer, and I was…

Ah, Fravia... Yes, his site was indeed a goldmine and I have fond memories of the many things I learned there in the 90's.

Curiously enough, the wikipedia page does not mention that part of the mystery of Fravia's site was that he kept his identity a secret.

Re: Reverse engineering the Intel FSP: A Primer

#15

Post by Fnoord »

jcranmer wrote: post #13
jlgaddis wrote: post #12

Earlier quoted context omitted.

> ... you should know that you're not strictly required to learn it to start experimenting with reverse engineering ... +1. The only assembly I ever learned was some 6502 assembly many, many years ago, and I didn't even learn that very well. But that didn't prevent me from later figuring out how to "crack" a bunch of BBS door games (with SoftICE for DOS) as a teenager. Hell, I'm not even a real programmer, and I was…

The newest versions of IDA Pro run on Linux and OS X as well.

And its bloody expensive for hobbyist usage [1]. 5.0 is free for non-commercial use but lacks all the features from 6.x and 7.x including Linux and macOS port.

[1] https://www.hex-rays.com/cgi-bin/quote.cgi

Re: Reverse engineering the Intel FSP: A Primer

#16

Post by jlgaddis »

Fnoord wrote: post #15
jcranmer wrote: post #13

Earlier quoted context omitted.

The newest versions of IDA Pro run on Linux and OS X as well.

And its bloody expensive for hobbyist usage [1]. 5.0 is free for non-commercial use but lacks all the features from 6.x and 7.x including Linux and macOS port. [1] https://www.hex-rays.com/cgi-bin/quote.cgi

Use 5.0 to reverse engineer 7.x and bypass the licensing? :)
Post reply on HN