flat assembler
Message board for the users of flat assembler.

Index > Tutorials and Examples > ultimate xor use

Goto page 1, 2  Next
Author
Thread Post new topic Reply to topic
Ali.Z



Joined: 08 Jan 2018
Posts: 820
Ali.Z 26 Jul 2018, 16:45
Code:
; standard and basic xor encryption
BASE = 2525h

_xor:
mov edx,BASE
xor edx,25h ; just any number to encrypt
; result is 2500h
; now to retrieve the encrypted number back
; xor base by result
xor edx,BASE ; remember edx have 2500h from last xor operation
; now edx have the original number which is 25h    


Code:
; another use of xor i dont know what to call it but it can be useful to store qword values and write them later to memory location
LOW_QWORD = 0ABCDEF10h
HIGH_QWORD = 23456789h
; FULL_QWORD = 23456789ABCDEF10h

_label:
mov edx,LOW_QWORD ; store the low 32bit value
xor edx,HIGH_QWORD ; we need the result
; result is 88888899h ; the KEY
mov eax,88888899h ; store it in eax for later use

; now to get the HIGH_QWORD, xor KEY by LOW_QWORD
xor edx,LOW_QWORD ; remember edx have 88888899h and being xored by ABCDEF10 which is low qword
; the result is 23456789h = high qword

; to get the LOW_QWORD xor KEY by the HIGH_QWORD
xor edx,eax ; = eax is our key 88888899h, edx = high qword
; result is 0ABCDEF10 = low qword    

_________________
Asm For Wise Humans
Post 26 Jul 2018, 16:45
View user's profile Send private message Reply with quote
MacroZ



Joined: 12 Oct 2018
Posts: 30
MacroZ 20 Oct 2018, 18:49
It can be used to flip bits
Code:
xor al,1 ; Flips the first bit    


Can we get another unique xor usage/trick by the next person? We want this thread to grow larger with unique answers. Forum users are encouraged to participate!

_________________
The king auto-generates two things to degrade dangerous artists and intellectuals. The King reserves the right to be king and has made the culprits in advance. Half of the time or more, they are auto-generated.
Post 20 Oct 2018, 18:49
View user's profile Send private message Reply with quote
HaHaAnonymous



Joined: 02 Dec 2012
Posts: 1178
Location: Unknown
HaHaAnonymous 20 Dec 2018, 12:03
MacroZ wrote:
It can be used to flip bits...

This is true. Nice find!
Code:
mov eax,1011b
; eax now is 1011b
xor eax,1000b
; eax now is 0011b
xor eax,1000b
; eax now is 1011b
xor eax,0001b
; eax now is 1010b
ret
    


Thank you!
Post 20 Dec 2018, 12:03
View user's profile Send private message Reply with quote
a



Joined: 10 Apr 2025
Posts: 17
Location: Ukraine
a 10 Apr 2025, 17:24
MacroZ wrote:
Can we get another unique xor usage/trick by the next person? We want this thread to grow larger

xor can be used to find a difference between 2 registers:
mov eax, 10000001b
mov ebx, 10000010b
xor eax,ebx
result: 00000011b, it shows us that the bits 1 and 2 are different from eachother.
You can use it to compare flags
and you can also get a position to WHERE it is different

you can use bsf ecx,eax instruction to get the first bit position into ecx
and if you want to get the next position then remove that bit with btr eax,ecx (ecx already contains a position to remove)
after that you can detect which next bit is different by using 2 above instructions in a loop
Post 10 Apr 2025, 17:24
View user's profile Send private message Reply with quote
Picnic



Joined: 05 May 2007
Posts: 1418
Location: Piraeus, Greece
Picnic 17 Apr 2025, 23:04
MacroZ wrote:
It can be used to flip bits
Can we get another unique xor usage/trick by the next person?


Some vintage XOR wizardry found in the legendary FASM forum over the years. 😎

Code:
; Swap two registers

xor eax, ebx     
xor ebx, eax     
xor eax, ebx  
    


Code:
; Equality comparison

mov eax, [value1]
mov ebx, [value2]
xor eax, ebx
jz equal_label  
    


Code:
; Encrypt / Decrypt (XOR cipher)

mov al, 'A'          ; character to be encrypted
mov bl, 0x5A         ; encryption key
xor al, bl           ; encryption step (AL now holds encrypted value)
; ...
; ...
xor al, bl           ; decryption step (AL returns to original 'A')
    


Code:
; ASCII character case manipulation

and al, 0DFh     ; convert to uppercase
or  al, 20h      ; convert to lowercase 
xor al, 20h      ; toggle case 
    


Code:
; XOR Bitwise NOT trick

not eax     ; same as xor eax, -1
    

_________________
âš¡ Hobby BASIC Interpreter | Get Started
Post 17 Apr 2025, 23:04
View user's profile Send private message Visit poster's website Reply with quote
Mat-Quasar



Joined: 02 Mar 2025
Posts: 82
Mat-Quasar 18 Apr 2025, 08:56
Picnic wrote:
MacroZ wrote:
It can be used to flip bits
Can we get another unique xor usage/trick by the next person?


Some vintage XOR wizardry found in the legendary FASM forum over the years. 😎

Code:
; Swap two registers

xor eax, ebx     
xor ebx, eax     
xor eax, ebx  
    


Code:
; Equality comparison

mov eax, [value1]
mov ebx, [value2]
xor eax, ebx
jz equal_label  
    


Code:
; Encrypt / Decrypt (XOR cipher)

mov al, 'A'          ; character to be encrypted
mov bl, 0x5A         ; encryption key
xor al, bl           ; encryption step (AL now holds encrypted value)
; ...
; ...
xor al, bl           ; decryption step (AL returns to original 'A')
    


Code:
; ASCII character case manipulation

and al, 0DFh     ; convert to uppercase
or  al, 20h      ; convert to lowercase 
xor al, 20h      ; toggle case 
    


Code:
; XOR Bitwise NOT trick

not eax     ; same as xor eax, -1
    


Nice info.

https://www.felixcloutier.com/x86/xor wrote:
Performs a bitwise exclusive OR (XOR) operation on the destination (first) and source (second) operands and stores the result in the destination operand location.
Post 18 Apr 2025, 08:56
View user's profile Send private message Reply with quote
AsmGuru62



Joined: 28 Jan 2004
Posts: 1708
Location: Toronto, Canada
AsmGuru62 18 Apr 2025, 13:36
These cases are wonderful from the artistic point of view.
But, in real code --- would you just not use XCHG or CMP?
Post 18 Apr 2025, 13:36
View user's profile Send private message Send e-mail Reply with quote
Furs



Joined: 04 Mar 2016
Posts: 2625
Furs 18 Apr 2025, 14:53
You can store 2 values into 1 with xor, and then use one of them to retrieve the other (but it can be either, unlike if you stored directly).

Code:
; we have 2 values a and b, simple example
mov eax, [a]
xor eax, [b]
mov [var], eax    

Now later if you have either a or b (not both but one of them), you can obtain the other from the var with xor:
Code:
mov eax, [var]
xor eax, [a]
; eax = b

mov eax, [var]
xor eax, [b]
; eax = a    
You can use this in double linked lists to only store the xor of "prev, next" and then iterate from either the head or the tail (forward or backward). You can't iterate from a middle point though, unless you know either its prev or next somehow.

But it will be a superior single linked list, since you can go either forward or backward while using the same amount of memory per node (only 1 pointer).
Post 18 Apr 2025, 14:53
View user's profile Send private message Reply with quote
macomics



Joined: 26 Jan 2021
Posts: 1149
Location: Russia
macomics 18 Apr 2025, 23:39
Furs wrote:
But it will be a superior single linked list, since you can go either forward or backward while using the same amount of memory per node (only 1 pointer).

Is that all?

You further evolve the idea.

For a 64-bit system, the pointer size is 8 bytes. Then, even if we switch to a double linked list with a single pointer, we will still 8 bytes to store these values. But the XOR operation does something else useful for such a list.

Let's say it is known that the pointer values for the elements of a double linked list are selected from a range not exceeding 64 kb. What then will be stored in the 8 bytes of the pointer? If XOR allows you to find all the different bits, then 0 will always be written in the top 6 bytes of the pointer because the address range at this location will always match. Then why use 8 bytes in such a list to store pointers, where the highest 6 bytes will always be 0? This way, you can create a double linked list and not store the full pointer, but only the low-order bits.

And let the 64 kb example be just a special case, but in general, the heap size in Windows is limited to 2 GB. Then 31-bits will always be enough to store pointers in such a list. Even in a 64-bit program.
Post 18 Apr 2025, 23:39
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20631
Location: In your JS exploiting you and your system
revolution 19 Apr 2025, 02:21
And if the list elements are aligned and of even (or other power-of-two) length then the lower bits can also be elided since they are always zero.
Post 19 Apr 2025, 02:21
View user's profile Send private message Visit poster's website Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20631
Location: In your JS exploiting you and your system
revolution 19 Apr 2025, 04:18
XOR is used in PRNGs based upon LFSRs.

XOR is used in CRC/BCH/ECC algorithms for data integrity checking.
Post 19 Apr 2025, 04:18
View user's profile Send private message Visit poster's website Reply with quote
macomics



Joined: 26 Jan 2021
Posts: 1149
Location: Russia
macomics 19 Apr 2025, 10:16
revolution wrote:
And if the list elements are aligned and of even (or other power-of-two) length then the lower bits can also be elided since they are always zero.
The alignment itself gives zero bits. They do not appear as a consequence of XOR. Therefore, such an abbreviation can be applied not only in a double linked XOR list.

But unlike the reduction of the higher digits, this operation will require more instructions. Whereas when the high-order digits are reduced, the XOR instruction remains the same.

Code:
; rax - previous element pointer
; rbx - current element pointer
    xor ax, [rbx] ; compute next element pointer
    xchg rax, rbx ; walk

;-----------------------------------------------------

; rax - previous element pointer
; rbx - current element pointer
    movzx rdx, word [rbx] ; get pointer
    imul rdx, rdx, alignment ; ...
    xor rax, rdx ; compute next element pointer
    xchg rax, rbx ; walk    
Post 19 Apr 2025, 10:16
View user's profile Send private message Reply with quote
Picnic



Joined: 05 May 2007
Posts: 1418
Location: Piraeus, Greece
Picnic 19 Apr 2025, 13:00
AsmGuru62 wrote:
These cases are wonderful from the artistic point of view.
But, in real code --- would you just not use XCHG or CMP?

Those tricks aren't always the most readable or practical choice for everyday development, but they're definitely fun to study and play around with.


Just found another one buried in my notes.
Code:

; if a <> 0 then a = b else a = c

cmp eax, 1
sbb eax, eax
xor ecx, ebx
and eax, ecx
xor eax, ebx
    

_________________
âš¡ Hobby BASIC Interpreter | Get Started
Post 19 Apr 2025, 13:00
View user's profile Send private message Visit poster's website Reply with quote
macomics



Joined: 26 Jan 2021
Posts: 1149
Location: Russia
macomics 19 Apr 2025, 13:22
Picnic wrote:
Just found another one buried in my notes.
Code:
; if a <> 0 then a = b else a = c

cmp eax, 1
sbb eax, eax
xor ecx, ebx
and eax, ecx
xor eax, ebx    


1) Ruins the value of C
2) a <> 1
3)
Code:
cmp eax, 1
cmovnz eax, ebx
cmovz eax, ecx    
Post 19 Apr 2025, 13:22
View user's profile Send private message Reply with quote
Picnic



Joined: 05 May 2007
Posts: 1418
Location: Piraeus, Greece
Picnic 19 Apr 2025, 13:25
macomics wrote:

1) Ruins the value of C


Yes, only ebx remains unchanged.

macomics wrote:
cmp eax, 1
cmovnz eax, ebx
cmovz eax, ecx


Nice, but not XOR here.

_________________
âš¡ Hobby BASIC Interpreter | Get Started
Post 19 Apr 2025, 13:25
View user's profile Send private message Visit poster's website Reply with quote
macomics



Joined: 26 Jan 2021
Posts: 1149
Location: Russia
macomics 19 Apr 2025, 13:32
Code:
; if a <> 0 then a = b else a = c

cmp eax, 1
sbb eax, eax
xor ecx, ebx
and eax, ecx
xor eax, ebx
xor ecx, ebx ; just not the full code    
Post 19 Apr 2025, 13:32
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20631
Location: In your JS exploiting you and your system
revolution 19 Apr 2025, 13:33
cmovcc is not available with XMM stuff. So those xor "tricks" are still valid there.

Also, not every CPU has xchg, x86 does, but ARM doesn't.
Post 19 Apr 2025, 13:33
View user's profile Send private message Visit poster's website Reply with quote
Picnic



Joined: 05 May 2007
Posts: 1418
Location: Piraeus, Greece
Picnic 19 Apr 2025, 13:39
macomics wrote:
Code:
; if a <> 0 then a = b else a = c

cmp eax, 1
sbb eax, eax
xor ecx, ebx
and eax, ecx
xor eax, ebx
xor ecx, ebx ; just not the full code    


Sweet! That extra line really makes a difference!

_________________
âš¡ Hobby BASIC Interpreter | Get Started
Post 19 Apr 2025, 13:39
View user's profile Send private message Visit poster's website Reply with quote
AsmGuru62



Joined: 28 Jan 2004
Posts: 1708
Location: Toronto, Canada
AsmGuru62 19 Apr 2025, 14:57
Hmmm... if only I cared about ARM...
Post 19 Apr 2025, 14:57
View user's profile Send private message Send e-mail Reply with quote
a



Joined: 10 Apr 2025
Posts: 17
Location: Ukraine
a 19 Apr 2025, 19:13
    1. xor can be used to decrypt CIA documents

    2. xor can be used to heal cancer

    3. xor can be used to time travel
Post 19 Apr 2025, 19:13
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  
Goto page 1, 2  Next

< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2025, Tomasz Grysztar. Also on GitHub, YouTube.

Website powered by rwasa.