Top
Best
New

Posted by piotrgrabowski 10 hours ago

Assembly Hall of Shame(github.com)
282 points | 65 comments
Retr0id 8 hours ago|
Related, and linked in the readme: https://github.com/xoreaxeaxeax/smiiiiiiiiiiiiiiii (using the slow instructions to break SMI)
jonathrg 6 hours ago|
I wish they would just explain it in normal terms instead of this nasty LLM "engaging blog post" style
twothreeone 3 hours ago|||
Chris usually takes an educational angle, I don't think this is LLM-generated content at all it's just his style. I highly encourage watching some of his DefCon or BlackHat talks, they're fun!
Brian_K_White 2 hours ago|||
I looked at both links and don't see anything weird or annoying, and I hate overblown styles myself.
kazinator 1 hour ago||
Bus cycles can be arbitrarily long on any processor that has memory cycles with a hand shake requiring an ack, with no timeout.

E.g. we can build a board around a MC68000 where we make it lock up forever in a bus cycle, waiting for a DTACK that doesn't arrive.

Some early microprocessors had clocked bus cycles without handshaking. They would put out an address on some address lines and signal some line together with a read/write indication, and then expect the transfer to be completed within some clock cycles. If nothing is attached to the address, they would read whatever values are on the bus, like maybe all 1's if it is an open drain system that requires the transmitting device to pull to ground to indicate zero.

I'd say that kind of thing belongs to a hall of shame; it requires software hacks to interface with anything that can't keep up with the prescribed bus cycle.

monocasa 7 hours ago||
It says in the rules

> Trapped/emulated/virtualized instructions may only time the trap, not the handler.

But I feel like that 12ms write to an ACPI IO port at current leaderboard position 8 is probably trapping to SMM and being handled there.

layer8 8 hours ago||
Nop should be #1, because it is infinitely slow for what it does. ;)
jooops1 8 hours ago||
It increments rip by one.
EvanAnderson 4 hours ago|||
I thought I remembered reading somewhere re: the 8086 microcode disassembly that NOP, which is encoded as XCHG AX,AX actually does run the XCHG microcode and uses an internal scratchpad register to do the exchange.
JoeAltmaier 4 hours ago||
There were several NOPs - XCHG BX,BX and so on. Those were taken later to be prefixes for new classes of opcodes.
fluoridation 6 hours ago|||
No, that's done by the decoder. It actually does nothing.
loeg 3 hours ago|||
The decoder is an implementation detail that is a subcomponent of NOP; GP was right, and your correction isn't.
fluoridation 3 hours ago||
It's not an implementation detail, because the decoder runs before the execution of every instruction. If we're going to say that NOP increments IP by one, then we should also say that ADD "stores in dst the addition of src and dst, as well as incrementing IP by the length of the instruction", and JMP imm "increments JMP by imm + the length of the instruction".
loeg 2 hours ago||
ADD does in fact do that.
fluoridation 1 hour ago||
I'm not disputing the total effect. I'm asking if you'd rather describe ADD and JMP in this manner, in order to say that NOP does not in fact do nothing.
dlcarrier 2 hours ago||||
It's still part of the instruction to increment it by one, as opposed to write a value or offset to it, as jump instructions do.
fluoridation 2 hours ago||
See my sibling response.
russdill 5 hours ago|||
I mean....there are several architectures out there which has a nop that is a jump forward. Kind of a tree forest issue imho
fluoridation 4 hours ago||
I don't know about other architectures in as much detail. I know x86 NOP does nothing.
hyperhello 2 hours ago|||
It's a little faster than yep.
mito88 8 hours ago||
Strategy: nop does nothing. It opens the leaderboard accordingly.

Score: 1 cycles Time: 0 nanoseconds

layer8 7 hours ago||
It opens the leaderboard as #27, so in the last place.
TomatoCo 9 hours ago||
This author also has other things like: A compiler that emits only `mov` instructions and another compiler that deliberately messes with the control flow so that, if disassembled, common debuggers will draw symbols like skulls or threats. https://github.com/xoreaxeaxeax/repsych
inigyou 8 hours ago|
He also bruteforced the entire opcode space to find undocumented instructions (sandsifter).
codeshaunted 9 hours ago||
what im seeing from this chart is that we should be using the nop instruction for everything
bee_rider 9 hours ago|
Well the best code is no code. Nop could be second best though.
inigyou 8 hours ago||
Instructions unclear. Set the NX bit to ensure no code, and got a general protection fault.
markus_zhang 7 hours ago||
Does that mean Chris Domas is ready for his next adventure?
simonebrunozzi 6 hours ago||
Related, somehow: Core War [0].

[0]: https://en.wikipedia.org/wiki/Core_War

michalsustr 8 hours ago|
Very cool! Also, huh interesting. I’ve used rdtsc to measure cycle diffs but had no idea its execution takes that long. Is that common across architectures?
pbsd 7 hours ago||
The cycle count for RDTSC is ~25 cycles on Skylake-era microarchitectures. The 49 number shown in the OP seems off.
inigyou 8 hours ago||
AFAIK it acts as some kind of execution barrier, to give meaningful timing.
rrampage 8 hours ago||
Isn't that rdtscp ( https://www.felixcloutier.com/x86/rdtscp )?
More comments...