<story><title>That XOR Trick (2020)</title><url>https://florian.github.io/xor-trick</url></story><parent_chain><item><author>danpalmer</author><text>As mentioned in this article, x ^ x == 0. Fun fact, this is frequently used by compilers as a &amp;quot;cheap&amp;quot; way to zero out a register.&lt;p&gt;In addition, there are comparatively few cases in programming where we XOR. Sure, it happens in things like games quite a lot, but the main use is actually _cryptography_.&lt;p&gt;Between these two facts (more like hints really), I managed to reverse engineer the bulk of a piece of malware I was given to analyse in a an internship. I was handed the malware, a copy of IDA Pro, and given a few days to see what I could find. All I could remember when presented with a wall of hex encoded machine code were the hints above. I looked for XORs of different values, assumed it was crypto, and extrapolated from there. Found a routine happening three times in quick succession and guessed it was triple-DES. Then I guessed that writing your own 3DES from scratch was unlikely, so googled for crypto libraries and happened to find one that nearly matched (I think an earlier&amp;#x2F;unmodified version), and worked my way up tagging the operations until I got to the purpose, exfiltrating various registry keys and browser history to [somewhere].&lt;p&gt;It was a fun exercise, and therefore these facts will stay with me for far longer than they are accurate I&amp;#x27;m sure!</text></item></parent_chain><comment><author>nickelpro</author><text>Xor&amp;#x27;ing registers isn&amp;#x27;t a compiler trick or arcane piece of lore, it&amp;#x27;s the canonical way to zero a register on most architectures. It&amp;#x27;s the only universally recommended way for both Intel and AMD x86 and x64 processors.</text></comment>
<story><title>That XOR Trick (2020)</title><url>https://florian.github.io/xor-trick</url></story><parent_chain><item><author>danpalmer</author><text>As mentioned in this article, x ^ x == 0. Fun fact, this is frequently used by compilers as a &amp;quot;cheap&amp;quot; way to zero out a register.&lt;p&gt;In addition, there are comparatively few cases in programming where we XOR. Sure, it happens in things like games quite a lot, but the main use is actually _cryptography_.&lt;p&gt;Between these two facts (more like hints really), I managed to reverse engineer the bulk of a piece of malware I was given to analyse in a an internship. I was handed the malware, a copy of IDA Pro, and given a few days to see what I could find. All I could remember when presented with a wall of hex encoded machine code were the hints above. I looked for XORs of different values, assumed it was crypto, and extrapolated from there. Found a routine happening three times in quick succession and guessed it was triple-DES. Then I guessed that writing your own 3DES from scratch was unlikely, so googled for crypto libraries and happened to find one that nearly matched (I think an earlier&amp;#x2F;unmodified version), and worked my way up tagging the operations until I got to the purpose, exfiltrating various registry keys and browser history to [somewhere].&lt;p&gt;It was a fun exercise, and therefore these facts will stay with me for far longer than they are accurate I&amp;#x27;m sure!</text></item></parent_chain><comment><author>gameswithgo</author><text>I feel like xor comes up all the time in programming! Perhaps generations that have almost entirely focuses on web front and backends never have use for it, but libraries underneath it all certainly are.</text></comment>