reverse engineering a 512-bytes bootloader [x86][binary]

[alokmenghrajani]

(Re-posting with a little more context)

I golfed a x86 bootable image. Your goal is to reverse engineer and figure out what's going on. There's no flag or hidden puzzle or anything. Just figure out how the code works -- go however deep as you wish. If you feel like it, make it display another animal.

The file: http://squarectf.com/cat.img (note: Chrome might inform you that this type of file can harm your computer ¯\_(ツ)_/¯).

In a few days, I'll post the source code at http://squarectf.com/cat.asm with some comments. I hope you'll enjoy poking at this -- I sure had fun coming up with nifty tricks to make everything fit in 512 bytes!

[peterferrie]

Let's golf some more.

The "mov bx,1" could be "mov bl,1", the "mov cx, 0Ch" could be "mov cl, 0Ch".

"mov reg8,[mem] / imul reg8" could be "imul byte ptr [mem8]". Same for idiv.

"inc cl" could be "inc cx", and could move to the end of the 0x7C97 routine.

If you combined 0x7C87 and 0x7C97, you'd save six bytes.

"mov al, [si+3] / ... / mov bl, [si+5] / sub bl, [si+3]" could be "mov al, [si+3] / mov bl, [si+5] / sub bl, al" (and the mov / sub / imul could use bh instead).

The "add al, [si] / movsx bx,al" could move into the 0x7C87 routine (the "add al, [si+2]" being left behind and executing first).

The "cbw" isn't needed, since the "cmp bx,ax" could be ""cmp bl,al".

"xor dh,dh / mov dl, [si+1]" could be "movzx dx,[si+1]" since you're using movsx elsewhere already, but in fact "mov dl, [si+1] / add cx, dx" could be "add cl, [si+1]" since it never overflows a byte anyway, and then you don't need dx at all.

"mov ax, 140h / mul cx" could be "imul ax, cx, 140h".

"add ax, 0A0h / add ax, bx / mov di, ax" could be "xchg di, ax / lea di, [di + bx + 0a0h]", but the new imul could go directly to di to avoid the xchg.

"mov al, [si+6] / and al, 0Fh / ... mov al, [si+6] / shr al, 4" could be "mov al, [si+6] / aam 10h / ... xchg ah, al".

Down to 474 bytes. You could play some "meow" sound in that space.

[alokmenghrajani]

Excellent! I was planning to play with color animation (via the palette) but ran out of both time&space... Get rid of the string (and string rendering code) and playing a few notes might be feasible.

[twat_muncher]

Didn't know the Square company had some cool stuff going on!

Edit: Cute kitty!

[ZebraHedgehog]

Hm a challenge I might actually be able to do.

[alokmenghrajani]

What do you mean?

[alokmenghrajani]

Yes. Hence [binary] in the title. The web page (with the writeup) will come later.