4 ms·
Can anyone find a version of A86 that actually encodes some information in its output, or is this just a legend? It produces different opcodes for some instruct
by rep_lodsb 4y ago
Can anyone find a version of A86 that actually encodes some information in its output, or is this just a legend? It produces different opcodes for some instructions than MASM, but so do DEBUG and various other assemblers. And the same instruction repeated multiple times always assembles to the same opcode as far as I have seen.
To prove some program was made with A86, there would have to be a more specific signature that wouldn't match any other assembler, like a copyright message encoded bit-by-bit in the opcode choice.
- rep_lodsb 4y agoTried it out now with different instructions. There's a pattern, though it's not quite a steganographic message, just a different encoding chosen depending on the second register operand. 02 C0 ADD AL,AL 02 C1 ADD AL,CL 00 D0 ADD AL,DL 00 D8 ADD AL,BL 02 C4 ADD AL,AH 02 C5 ADD AL,CH 00 F0 ADD AL,DH 00 F8 ADD AL,BH Don't know if this would hold up in court for proving that some code was assembled with A86... edit: other ALU ops are the same; for MOV the "direction bit" is inverted.
- a1369209993 4y agoThat's not a a86 thing; it's to avoid generating a modrm byte that can be decoded as a return instruction[0] for ROP gadgets. $ zasm -Mx86 -='add al al;add al dl;add dl al' 000000 - 02 C0 00 D0 02 D0 |...... | $ hex C3 | ndisasm -au - 00000000 C3 ret 0: C2, C3, CA, or CB, so modrm (ax/cx) (dx/bx)
- rep_lodsb 4y agoROP wasn't a concept back then. From the manual of the latest version of A86: A86 assembler package V4.05 January 14, 2000 The entire package is Copyright 2000 Eric Isaacson. All rights reserved.