About
Articles
Book Store
Distributed RCE
Downloads
Event Calendar
Forums
Live Discussion
Reference Library
RSS Feeds
Search
Store
Users
What's New
Customize Theme
bluegrey
blackgreen
metal
simple
Flag:
Tornado!
Hurricane!
Login:
Password:
Remember Me
Register
Blogs
>>
GynvaelColdwind
's Blog
Created: Tuesday, December 29 2009 10:54.50 CST
Printer Friendly ...
BSWAP + 66h prefix (bochs, QEMU detection)
Author:
GynvaelColdwind
# Views:
2299
In the last few days I've been playing with osdev again (last time I've coded something more than a boot menu, was in 2003), so expect a few posts about assembler, x86 emulators and similar institutions. Today's post will be about the
bswap reg16
instruction, running in protected mode - which, as one will find out, can be used, for example, to detect bochs or QEMU.
The
bswap reg16
instruction is in fact a
bswap reg32
with the
66h prefix
, also known as the operand-size override prefix (it switches the operands between 32 and 16 bits, where 32 is the default in PMODE of course). As one can read in the Intel manuals, using bswap with the 66h prefix will result in getting an
undefined behavior
.
Read the full post...
Blog Comments
PeterFerrie
Posted: Wednesday, December 30 2009 23:08.52 CST
DOSBox had this bug until recently, too. It's a problem that people rediscover every so often. :-)
As far as "undefined" behaviour, it's completely defined, they just don't want to tell you what it is.
Anyway, it's always behaved in the same way since the 486 was released - the top 16 bits are zero in 16-bit mode, so they get swapped in. My emulator has always supported that behaviour.
GynvaelColdwind
Posted: Thursday, December 31 2009 07:43.35 CST
@PeterFerrie
Thanks for commenting! I've updated the post on my blog with the information you provided ;>
Haha the CPUs are getting more and more interesting. So many interesting stories and pieces of interesting information related to just one small bswap instruction ;>
Add New Comment
Comment:
There are
21,677
total registered users.
Recently Created Topics
PyEmu error when cal...
Sep/02
Restore Themida/Winl...
Sep/02
Anti-olly technique
Aug/30
RAR Password
Aug/29
Heap protection on W...
Aug/23
Why Inline asm in C+...
Aug/20
Bypassing OllyAdvance
Aug/17
Error in logic for g...
Aug/17
Has anyone seen this...
Aug/17
ARM Executable - Pat...
Aug/16
Recent Forum Posts
reverse engineering ...
raiden56
pydbg, memory breakp...
Researc...
RAR Password
Ineedhelp
RAR Password
cod
Heap protection on W...
voila
Heap protection on W...
j00ru
Heap protection on W...
voila
Heap protection on W...
j00ru
Heap protection on W...
psylocn
Why Inline asm in C+...
ronnie2...
Recent Blog Entries
meshmesh
Sep/01
Is it legal??
waleedassar
Aug/30
Anti-olly technique
QvasiModo
Aug/24
WinAppDbg 1.4 is out!
artemblagodarenko
Aug/18
Dataflow-0.2.0 released. Ne...
grzonu
Aug/17
Bypassing OllyAdvanced
More ...
Recent Blog Comments
tosanjay
on:
Sep/02
PyEmu 0.0.2
GynvaelColdwind
on:
Sep/01
Is it legal??
PeterFerrie
on:
Aug/31
Anti-olly technique
dennis
on:
Aug/26
Dr. Gadget IDAPython plugin
halsten
on:
Aug/19
Dataflow-0.2.0 released. Ne...
More ...
Imagery
SoySauce Blueprint
Jun 6, 2008
[+] expand
View Gallery
(11) /
Submit