3 ms·
"Yet once again, we were stuck looking at a binary blob. And this time, we had no real HLE code to go off of. Luckily, Cydrak recognized the ISA just from looki
by SoftwarePatent 15y ago
"Yet once again, we were stuck looking at a binary blob. And this time, we had no real HLE code to go off of. Luckily, Cydrak recognized the ISA just from looking at the binary: it was an ARMv3 CPU!"
From the perspective of a software guy, this sounds very impressive. Can some hardware guy chime in and tell us just how impressive it is to recognize a CPU from looking at a binary dump?
- sern 15y agoNot particularly - ARM instruction encoding is rather distinct. Repeating "always" values of the ARM condition field really stand out.
- wladimir 15y agoThe instruction size is the first thing that is apparent. By looking at the pattern you can distinguish between fixed-sized, or variable-sized instructions, telling a lot about the architecture. ARM either has 16 bit (thumb mode) or 32 bit (normal) fixed-size instructions. Also for every ISA there are some instructions that are very common, for example x86 has very-recognizable NOPs (0x90). Having said that, seeing it is ARMv3 code specifically in one glance is pretty impressive.
- rcfox 15y ago> Having said that, seeing it is ARMv3 code specifically in one glance is pretty impressive. You seem to have added some hyperbole. There was no mention of "in one glance". Also, it's likely that he recognized that it was ARMvSomething (which is relatively easy) and then did some comparisons to narrow it down.
- ootachi 15y agoARM is by far the easiest ISA to do this with: since the vast majority of instructions begins with an "always" condition code, and the condition code is a nibble (0xe), you can pick out ARM instructions easily.