<story><title>That XOR Trick (2020)</title><url>https://florian.github.io/xor-trick</url></story><parent_chain><item><author>oconnor663</author><text>Why does mov&amp;#x27;ing a constant end up having overhead?</text></item><item><author>mytailorisrich</author><text>&lt;i&gt;xor reg, reg&lt;/i&gt; is indeed the standard way to zero out a register in x86 assembly (it&amp;#x27;s not just a compiler trick) as it is both shorter and faster than loading the register with zero via a &lt;i&gt;mov&lt;/i&gt;.&lt;p&gt;Apart from that, I&amp;#x27;d say that a common use of XOR operations in general are interactions with hardware peripherals where manipulating bit fields are needed.</text></item><item><author>danpalmer</author><text>As mentioned in this article, x ^ x == 0. Fun fact, this is frequently used by compilers as a &amp;quot;cheap&amp;quot; way to zero out a register.&lt;p&gt;In addition, there are comparatively few cases in programming where we XOR. Sure, it happens in things like games quite a lot, but the main use is actually _cryptography_.&lt;p&gt;Between these two facts (more like hints really), I managed to reverse engineer the bulk of a piece of malware I was given to analyse in a an internship. I was handed the malware, a copy of IDA Pro, and given a few days to see what I could find. All I could remember when presented with a wall of hex encoded machine code were the hints above. I looked for XORs of different values, assumed it was crypto, and extrapolated from there. Found a routine happening three times in quick succession and guessed it was triple-DES. Then I guessed that writing your own 3DES from scratch was unlikely, so googled for crypto libraries and happened to find one that nearly matched (I think an earlier&amp;#x2F;unmodified version), and worked my way up tagging the operations until I got to the purpose, exfiltrating various registry keys and browser history to [somewhere].&lt;p&gt;It was a fun exercise, and therefore these facts will stay with me for far longer than they are accurate I&amp;#x27;m sure!</text></item></parent_chain><comment><author>nickelpro</author><text>It&amp;#x27;s not overhead, it&amp;#x27;s about dependency breaking. 32-bit xors on a single register are universally recognized as a zeroing idiom, which means the CPU doesn&amp;#x27;t have to wait for the results of previous operations in order to set the value of the applicable register to zero.&lt;p&gt;In modern CPUs zero&amp;#x27;ing idioms aren&amp;#x27;t even executed, they only get as far as the register allocater. The register allocater will allocate a zero&amp;#x27;d physical register for the architectural register that had the idiom applied to it and the job is done.</text></comment>
<story><title>That XOR Trick (2020)</title><url>https://florian.github.io/xor-trick</url></story><parent_chain><item><author>oconnor663</author><text>Why does mov&amp;#x27;ing a constant end up having overhead?</text></item><item><author>mytailorisrich</author><text>&lt;i&gt;xor reg, reg&lt;/i&gt; is indeed the standard way to zero out a register in x86 assembly (it&amp;#x27;s not just a compiler trick) as it is both shorter and faster than loading the register with zero via a &lt;i&gt;mov&lt;/i&gt;.&lt;p&gt;Apart from that, I&amp;#x27;d say that a common use of XOR operations in general are interactions with hardware peripherals where manipulating bit fields are needed.</text></item><item><author>danpalmer</author><text>As mentioned in this article, x ^ x == 0. Fun fact, this is frequently used by compilers as a &amp;quot;cheap&amp;quot; way to zero out a register.&lt;p&gt;In addition, there are comparatively few cases in programming where we XOR. Sure, it happens in things like games quite a lot, but the main use is actually _cryptography_.&lt;p&gt;Between these two facts (more like hints really), I managed to reverse engineer the bulk of a piece of malware I was given to analyse in a an internship. I was handed the malware, a copy of IDA Pro, and given a few days to see what I could find. All I could remember when presented with a wall of hex encoded machine code were the hints above. I looked for XORs of different values, assumed it was crypto, and extrapolated from there. Found a routine happening three times in quick succession and guessed it was triple-DES. Then I guessed that writing your own 3DES from scratch was unlikely, so googled for crypto libraries and happened to find one that nearly matched (I think an earlier&amp;#x2F;unmodified version), and worked my way up tagging the operations until I got to the purpose, exfiltrating various registry keys and browser history to [somewhere].&lt;p&gt;It was a fun exercise, and therefore these facts will stay with me for far longer than they are accurate I&amp;#x27;m sure!</text></item></parent_chain><comment><author>detaro</author><text>It&amp;#x27;s larger, because it needs to fit a 32bit value of 0 in the instruction, and thus e.g. on x86 needs 5 bytes, whereas xor reg,reg needs 2. As such it was a common code size optimization, which in turn has lead to CPU manufacturers optimizing their CPUs to recognize it and treat it even more efficiently.</text></comment>