Hacker News Reader

Comment by SoftwarePatent | Hacker News Reader

"Yet once again, we were stuck looking at a binary blob. And this time, we had no real HLE code to go off of. Luckily, Cydrak recognized the ISA just from looking at the binary: it was an ARMv3 CPU!"

From the perspective of a software guy, this sounds very impressive. Can some hardware guy chime in and tell us just how impressive it is to recognize a CPU from looking at a binary dump?

View on HN

The instruction size is the first thing that is apparent. By looking at the pattern you can distinguish between fixed-sized, or variable-sized instructions, telling a lot about the architecture. ARM either has 16 bit (thumb mode) or 32 bit (normal) fixed-size instructions.

Also for every ISA there are some instructions that are very common, for example x86 has very-recognizable NOPs (0x90).

Having said that, seeing it is ARMv3 code specifically in one glance is pretty impressive.

> Having said that, seeing it is ARMv3 code specifically in one glance is pretty impressive.

You seem to have added some hyperbole. There was no mention of "in one glance".

Also, it's likely that he recognized that it was ARMvSomething (which is relatively easy) and then did some comparisons to narrow it down.

ARM is by far the easiest ISA to do this with: since the vast majority of instructions begins with an "always" condition code, and the condition code is a nibble (0xe), you can pick out ARM instructions easily.

Not particularly - ARM instruction encoding is rather distinct. Repeating "always" values of the ARM condition field really stand out.

Reply on news.ycombinator.com