Decompilation of x86 assembly into c language -- if statement

1, Tested C statements and compiled x86 assembly code

int a;
int b;

int main(void) {
    int c;

    if (c)
            a = 4;
        else
            b = 5;

    return 0;
}
 1 .text:0000000000400457                 push    rbp
 2 .text:0000000000400458                 mov     rbp, rsp
 3 .text:000000000040045B                 sub     rsp, 10h
 4 .text:000000000040045F                 mov     [rbp-10], rsp
 5 .text:0000000000400463                 lea     rax, [rbp-4]
 6 .text:0000000000400467                 movsxd  rax, dword ptr [rax]
 7 .text:000000000040046A                 cmp     eax, 0
 8 .text:000000000040046D                 jz      short loc_400483
 9 .text:000000000040046F                 lea     rax, a
10 .text:0000000000400476                 push    rax
11 .text:0000000000400477                 mov     rax, 4
12 .text:000000000040047E                 pop     rdi
13 .text:000000000040047F                 mov     [rdi], eax
14 .text:0000000000400481                 jmp     short loc_400495
15 .text:0000000000400483 ; ---------------------------------------------------------------
16 .text:0000000000400483
17 .text:0000000000400483 loc_400483:                             ; CODE XREF: main+16↑j
18 .text:0000000000400483                 lea     rax, b
19 .text:000000000040048A                 push    rax
20 .text:000000000040048B                 mov     rax, 5
21 .text:0000000000400492                 pop     rdi
22 .text:0000000000400493                 mov     [rdi], eax
23 .text:0000000000400495
24 .text:0000000000400495 loc_400495:                             ; CODE XREF: main+2A↑j
25 .text:0000000000400495                 mov     rax, 0
26 .text:000000000040049C                 jmp     short loc_4004A5
27 .text:000000000040049E ; ---------------------------------------------------------------
28 .text:000000000040049E                 mov     rax, 0
29 .text:00000000004004A5
30 .text:00000000004004A5 loc_4004A5:                             ; CODE XREF: main+45↑j
31 .text:00000000004004A5                 mov     rsp, rbp
32 .text:00000000004004A8                 pop     rbp
33 .text:00000000004004A9                 retn

 

2, x86 assembly to virtual machine assembly

The fourth sentence "mov [rbp-10], rsp", memory address   [rbp-10] assign a value to "MOV, RBP, RSP" in the second sentence, so the fourth sentence is transformed into

"Mov [rsp-10], RSP", and then judge the value of RSP. RSP is "sub rsp, 10h" in the third sentence, so the fourth sentence is transformed into "mov [rsp-10], rsp-10",

At this time, you can define the variable V1 with the address [rsp-10], and generate the virtual machine assembly statement V1 = & v1.

The eighth sentence "jz short loc_400483" is also the statement we focus on, because it is a conditional jump, and the execution flow of the program may be due to

This statement is no longer executed sequentially. The jump in the eighth sentence determines whether the z-bit of the flag bit of the cpu flag register is 0, so search for the latest affected flag bit

The seventh sentence is "cmp eax, 0", and the sixth sentence is "movsxd"   rax, dword ptr [rax]",

This is a read memory operation. Continue to look up who modified rax. Find the fifth sentence "lea rax, [rbp-4]", and then generate the variable V2 with the address of v2

[rbp-4], and generate an IF statement. The condition of the if statement is judged as v2.

Continue to analyze the assembly statement downward. The next assembly statement is the then part of the if statement. When you encounter the 13th sentence "mov [rdi], eax", this is a

Write memory operation, analyze memory address and value. The memory address is in rdi. The 12th sentence is "pop rdi". Continue to search for the recent stack pressing operation and encounter the 10th sentence

"push rax", continue to analyze the value of rax. In the ninth sentence, "lea rax, a", rdi is the address of A. Let's pursue eax, the 11th sentence "mov rax, 4",

The virtual machine assembly statement a = 4 is generated. In the 14th sentence, jmp generates a goto tag and the then part until the assembly language address is less than the address LOC_ four hundred thousand four hundred and eighty-three

Up to the maximum value of.

Let's analyze the eighth sentence "jz short loc_400483" and jump to LOC_ 400483. The following statement is the else part of if. After analysis, see section 22

Sentence "mov"       [rdi], eax ", this is a write memory operation to analyze the memory address and value. The memory address is in RDI, and the 21st sentence is "pop"       rdi",

Continue to search for the latest stack pressing operation. In the 19th sentence, "push rax", continue to analyze the value of rax. In the 18th sentence, "lea rax, b", rdi is the address of b. Again

In pursuit of eax, the 20th sentence "mov rax, 5" generates the virtual machine assembly statement b = 5. At this time, judge whether the address of the assembly instruction is greater than that generated in the 14th sentence

goto tag, if greater than or equal to, ends the else part.

 

 

3, Virtual machine assembly to c language

 

1. Virtual machine assembly language

The code paragraph reads as follows:

                 |OP_GET_LOCAL|

                 |1|

                 |OP_JUMP_IF_FALSE|

                 |0xXX|

                 |0xXX|  

                 |OP_POP|

                 |OP_CONSTANT|

                 |0|

                 |OP_SET_GLOBAL|

                 |2|

                 |OP_JUMP|

                 |0xYY|

         |0xYY|

     0xXXXX: |OP_POP|

         |OP_CONSTANT|

         |1|

         |OP_SET_GLOBAL|

      |3|

0xYYYY: | other instructions|

 

The constant segment is:

  |4|

  |5|

  |a|

  |b|

 

The Local segment is:

  |v1|

  |v2|

The execution process of the above statement is OP_GET_LOCAL 1 pushes the variable v2 to the stack, OP_JUMP_IF_FALSE judge stack top v2

Whether it is true. If it is true, it will not jump and execute the then branch. Otherwise, it will jump to 0xXXXX and run the else branch. In the then branch, first put v2 at the top of the stack

Pop up, then push constant 4 onto the stack, and then write 4 to variable a. Then jump to 0xYYYY and run the following statement. else branch

The stack top v2 pops up, then pushes the constant 5 into the stack, and then writes 5 to the variable b.

 

 

2. Decompile to c language

Encountered OP_JUMP_IF_FALSE, generate an IF statement. The condition of if is the top element of the stack. Track the operation at the top of the stack. It is

OP_GET_LOCAL, the condition of the if statement is v2.

Sequential analysis to OP_SET_GLOBAL 2, this statement writes the public variable a with the value OP_CONSTANT 0 pushes in 4 to generate a statement

a = 4. OP_JUMP generates a label, and the then part of the if statement ends, because the assembly address has reached 0xXXXX.

Then analyze the instruction from 0xXXXX, OP_SET_GLOBAL   3. This statement writes the public variable b with the value

OP_ The 5 pushed by constant 1 generates the statement b = 5. The else branch ends because the assembly address has reached the OP_JUMP

Generated label.

 

  

Posted on Mon, 29 Nov 2021 06:48:28 -0500 by kusal