Binary Analysis Patterns

; if (a == b)cmp eax, ebxjne skip_block; ... if body ...skip_block:
; if (a < b) - signedcmp eax, ebxjge skip_block    ; Jump if greater or equal; ... if body ...skip_block:
; if (a < b) - unsignedcmp eax, ebxjae skip_block    ; Jump if above or equal; ... if body ...skip_block:

; for (int i = 0; i < n; i++)xor ecx, ecx           ; i = 0loop_start:cmp ecx, [n]           ; i < njge loop_end; ... loop body ...inc ecx                ; i++jmp loop_startloop_end:
; while (condition)jmp loop_checkloop_body:; ... body ...loop_check:cmp eax, ebxjl loop_body
; do-whileloop_body:; ... body ...cmp eax, ebxjl loop_body

; Jump table patternmov eax, [switch_var]cmp eax, max_caseja default_casejmp [jump_table + eax*8]
; Sequential comparison (small switch)cmp eax, 1je case_1cmp eax, 2je case_2cmp eax, 3je case_3jmp default_case

; array[i] - 4-byte elementsmov eax, [rbx + rcx*4]        ; rbx=base, rcx=index
; array[i] - 8-byte elementsmov rax, [rbx + rcx*8]
; Multi-dimensional array[i][j]; arr[i][j] = base + (i * cols + j) * element_sizeimul eax, [cols]add eax, [j]mov edx, [rbx + rax*4]

; Accessing struct fieldsmov rdi, [struct_ptr]mov eax, [rdi]         ; s->a (offset 0)movzx eax, byte [rdi+4] ; s->b (offset 4)mov rax, [rdi+8]       ; s->c (offset 8)movzx eax, word [rdi+16] ; s->d (offset 16)

; while (node != NULL)list_loop:test rdi, rdi          ; node == NULL?jz list_done; ... process node ...mov rdi, [rdi+8]       ; node = node->next (assuming next at offset 8)jmp list_looplist_done:

; strlen patternxor ecx, ecxstrlen_loop:cmp byte [rdi + rcx], 0je strlen_doneinc ecxjmp strlen_loopstrlen_done:; ecx contains length
; strcpy patternstrcpy_loop:mov al, [rsi]mov [rdi], altest al, aljz strcpy_doneinc rsiinc rdijmp strcpy_loopstrcpy_done:
; memcpy using rep movsbmov rdi, destmov rsi, srcmov rcx, countrep movsb

; Multiplication by constant; x * 3lea eax, [rax + rax*2]
; x * 5lea eax, [rax + rax*4]
; x * 10lea eax, [rax + rax*4]  ; x * 5add eax, eax            ; * 2
; Division by power of 2 (signed)mov eax, [x]cdq                     ; Sign extend to EDX:EAXand edx, 7              ; For divide by 8add eax, edx            ; Adjust for negativesar eax, 3              ; Arithmetic shift right
; Modulo power of 2and eax, 7              ; x % 8

; Test specific bittest eax, 0x80          ; Test bit 7jnz bit_set
; Set bitor eax, 0x10            ; Set bit 4
; Clear bitand eax, ~0x10          ; Clear bit 4
; Toggle bitxor eax, 0x10           ; Toggle bit 4
; Count leading zerosbsr eax, ecx            ; Bit scan reversexor eax, 31             ; Convert to leading zeros
; Population count (popcnt)popcnt eax, ecx         ; Count set bits

; Local variable at rbp-8mov qword [rbp-8], rax  ; Store to localmov rax, [rbp-8]        ; Load from local
; Stack-allocated arraylea rax, [rbp-0x40]     ; Array starts at rbp-0x40mov [rax], edx          ; array[0] = valuemov [rax+4], ecx        ; array[1] = value

; Identify parameters by register usagefunc:    ; rdi used as first param (System V)    mov [rbp-8], rdi    ; Save param to local    ; rsi used as second param    mov [rbp-16], rsi    ; Identify return by RAX at end    mov rax, [result]    ret

; 1-byte operations suggest char/boolmovzx eax, byte [rdi]   ; Zero-extend bytemovsx eax, byte [rdi]   ; Sign-extend byte
; 2-byte operations suggest shortmovzx eax, word [rdi]movsx eax, word [rdi]
; 4-byte operations suggest int/floatmov eax, [rdi]movss xmm0, [rdi]       ; Float
; 8-byte operations suggest long/double/pointermov rax, [rdi]movsd xmm0, [rdi]       ; Double