Same program, four stories#
SLOP8445 · Spine lecture 1 · Block I
One file, all semester#
value[0] = input + 0x01010101u;
value[0] ^= 0x12345678u;
value[0] += 0x1337u;
value[0] -= 0x1111u;483 lines of C. Six exported functions. Six expected 32-bit answers, checked by the program itself.
Frozen before any build: 39FEF0BB…906B99D2
Four descriptions of one addition#
| Representation | What it says |
|---|---|
| C source | input + 0x01010101u |
| LLVM IR | load, add, getelementptr, store volatile |
| x64 | mov, add, mov — three instructions |
| recovered CFG | one basic block, no edges |
All four are true at the same time.
Four numbers for the size of one function#
- 155 LLVM IR instructions
- 115 x64 machine instructions
- 467 bytes, prologue to return
- 51 machine instructions at
-O1
Nothing was obfuscated. Nothing was hidden.
The compiler got there first#
Where a transformation can be applied#
| Layer | What follows it |
|---|---|
| C source | the entire native compiler |
| LLVM IR | LLVM optimisation, then instruction selection |
| x86 backend | nothing in IR metrics will see it |
| linked binary | nothing at all |
The layer decides what survives. Week 5 measures it.
The habit#
Before saying what a listing means, say:
- which representation
- at which optimisation level
- against which comparator
- counted by which convention
Landmarks, not proofs#
14000103c: 05 01 01 01 01 addl $0x1010101, %eax
1400010a2: 35 78 56 34 12 xorl $0x12345678, %eax0x12345678 is how you find the same computation again.
It is not evidence that the operation around it still does what the source said.
What the corpus is not#
- no allocator traffic, no threads, no exceptions
- exported, non-inlined targets with memorable constants
- volatile inputs so nothing folds to a constant
- Windows x64 PE only
A controlled specimen. Not a model of production software.
Block I#
- Week 1 — one addition, three representations, four numbers
- Week 2 — five tools, one of which produced eight broken binaries
- Week 3 — the oldest trick, undone by the backend
A bigger listing tells you almost nothing#
The whole course is about what does tell you something.