~ This file is a commented hexadecimal representation of a compiled ~ program, the output of Evocation's hex transform. The comments are ~ intended to allow a human reader to audit it. You can convert it to a ~ runnable executable by piping it through the program named 'hex' and ~ chmodding the output 755. The difference between a source and a binary ~ is comments! Enjoy. :) ~ This particular program is 'hex' itself. You of course already need to ~ have a binary copy of it to use this file, but you may find it helpful ~ to have this hex dump anyway, to aid in auditing your binary. ~ ELF file header ~ * denotes mandatory fields according to breadbox 7f 45 4c 46 ~ *magic number 02 ~ 64-bit 01 ~ little-endian 01 ~ ELF header format v1 00 ~ System-V ABI 00 00 00 00 00 00 00 00 ~ (padding) 02 00 ~ *executable 3e 00 ~ *Intel x86-64 01 00 00 00 ~ ELF format version 78 00 00 08 00 00 00 00 ~ *entry point 40 00 00 00 00 00 00 00 ~ *program header offset 00 00 00 00 00 00 00 00 ~ section header offset 00 00 00 00 ~ processor flags 40 00 ~ ELF header size 38 00 ~ *program header entry size 01 00 ~ *number of program header entries 00 00 ~ section header entry size 00 00 ~ number of section header entries 00 00 ~ section name string table index ~ ELF program header 01 00 00 00 ~ *"loadable" segment type 07 00 00 00 ~ *read+write+execute permission 00 00 00 00 00 00 00 00 ~ *offset in file 00 00 00 08 00 00 00 00 ~ *virtual address 00 00 00 00 00 00 00 00 ~ physical address (ignored) e0 01 00 00 00 00 00 00 ~ *size in file e0 01 00 00 00 00 00 00 ~ *size in memory 00 00 00 00 00 00 00 00 ~ segment alignment ~ This is the start routine, the first thing that runs when the ELF loads. ~ The basic registers preserved across syscalls are rbx, rsp, rbp. ~ To avoid redundant moves, we store the buffer pointer in rbx just once, ~ and keep it there. We've made sure our load origin fits in 32 bits, so ~ we can use imm32 for that. We're going to want to do an indirect load ~ from it, so we can't use rbp for this. 48 c7 c3 d8 01 00 08 ~ 0x080001d8 :rbx mov-reg64-imm32 e8 88 00 00 00 ~ 0x00000088 call-rel-imm32 ~ If the length is 0, we got EOF. If it's less than zero, we got a read ~ error. Either way, we exit. This is a signed comparison, as it needs to ~ be. 48 83 f8 00 ~ 0x00 :rax cmp-reg64-imm8 74 72 ~ 0x72 :cc-equal jmp-cc-rel-imm8 7c ee ~ 0xee :cc-less jmp-cc-rel-imm8 ~ Now that the length is handled, retrieve the input byte. 48 8b 03 ~ :rbx :rax mov-reg64-indirect-reg64 ~ If it's space or linefeed, skip it (go back to the loop start). 48 83 f8 20 ~ 0x20 :rax cmp-reg64-imm8 ~ ASCII space 74 ea ~ 0xffffffffffffffea :cc-equal jmp-cc-rel-imm8 48 83 f8 0a ~ 0x0a :rax cmp-reg64-imm8 ~ ASCII linefeed 74 e4 ~ 0xffffffffffffffe4 :cc-equal jmp-cc-rel-imm8 ~ If it's a comment, skip the whole thing. 48 83 f8 7e ~ 0x7e :rax cmp-reg64-imm8 ~ ASCII tilde 74 43 ~ 0x43 :cc-equal jmp-cc-rel-imm8 ~ Decode the value, or exit with an error. e8 79 00 00 00 ~ 0x00000079 call-rel-imm32 ~ We use rbp as a place to stash the high nibble. 48 89 c5 ~ :rax :rbp mov-reg64-reg64 48 c1 c5 04 ~ 0x04 :rbp rol-reg64-imm8 ~ Now we read another byte. e8 5a 00 00 00 ~ 0x0000005a call-rel-imm32 ~ Handle the length. A second hex digit is required here. 48 83 f8 00 ~ 0x00 :rax cmp-reg64-imm8 74 ac ~ 0xac :cc-equal jmp-cc-rel-imm8 7c c0 ~ 0xc0 :cc-less jmp-cc-rel-imm8 ~ Now that the length is handled, retrieve the input byte. 48 8b 03 ~ :rbx :rax mov-reg64-indirect-reg64 ~ Decode the value, or exit with an error. e8 5d 00 00 00 ~ 0x0000005d call-rel-imm32 ~ We OR in the low nibble. 48 0b e8 ~ :rax :rbp or-reg64-reg64 ~ Output the byte. We reuse the buffer as a place to store it. 48 89 2b ~ :rbx :rbp mov-indirect-reg64-reg64 48 89 de ~ :rbx :rsi mov-reg64-reg64 ~ buffer pointer 48 c7 c2 01 00 00 00 ~ 0x00000001 :rdx mov-reg64-imm32 ~ buffer length 48 c7 c0 01 00 00 00 ~ 0x00000001 :rax mov-reg64-imm32 ~ syscall number for sys-write 48 c7 c7 01 00 00 00 ~ 0x00000001 :rdi mov-reg64-imm32 ~ file descriptor 1 is stdout 0f 05 ~ syscall ~ Back to the start of the loop. eb 9b ~ 0xffffffffffffff9b jmp-rel-imm8 ~ Read a byte for the comment. e8 23 00 00 00 ~ 0x00000023 call-rel-imm32 ~ Handle the length. We're allowed to end in a comment. 48 83 f8 00 ~ 0x00 :rax cmp-reg64-imm8 74 0d ~ 0x0d :cc-equal jmp-cc-rel-imm8 7c 89 ~ 0x89 :cc-less jmp-cc-rel-imm8 ~ Now that the length is handled, retrieve the input byte. 48 8b 03 ~ :rbx :rax mov-reg64-indirect-reg64 ~ If it's linefeed, the comment is over. 48 83 f8 0a ~ 0x0a :rax cmp-reg64-imm8 ~ ASCII linefeed 74 85 ~ 0xffffffffffffff85 :cc-equal jmp-cc-rel-imm8 ~ We're still in the comment, keep handling it. eb e8 ~ 0xffffffffffffffe8 jmp-rel-imm8 ~ This is the routine named "exit". 48 c7 c0 3c 00 00 00 ~ 0x0000003c :rax mov-reg64-imm32 ~ syscall number for sys-exit 48 c7 c7 00 00 00 00 ~ 0x00000000 :rdi mov-reg64-imm32 ~ exit code 0f 05 ~ syscall ~ This is the routine named "read-byte". ~ We use self-xor as a concise way to set registers to zero. 48 33 c0 ~ :rax :rax xor-reg64-reg64 ~ syscall number for sys-read 48 33 ff ~ :rdi :rdi xor-reg64-reg64 ~ file descriptor 0 is stdin 48 89 de ~ :rbx :rsi mov-reg64-reg64 ~ buffer pointer ~ We read one byte at a time, because it makes the loop structure simple. 48 c7 c2 01 00 00 00 ~ 0x00000001 :rdx mov-reg64-imm32 ~ buffer length 0f 05 ~ syscall c3 ~ ret ~ This is the routine named "decode-nibble". 48 83 e8 30 ~ 0x30 :rax sub-reg64-imm8 ~ ASCII zero 7c 29 ~ 0x29 :cc-less jmp-cc-rel-imm8 48 83 f8 0a ~ 0x0a :rax cmp-reg64-imm8 72 22 ~ 0x22 :cc-below jmp-cc-rel-imm8 48 83 e8 11 ~ 0x11 :rax sub-reg64-imm8 ~ ASCII capital A 7c 1d ~ 0x1d :cc-less jmp-cc-rel-imm8 48 83 c0 0a ~ 0x0a :rax add-reg64-imm8 48 83 f8 10 ~ 0x10 :rax cmp-reg64-imm8 72 12 ~ 0x12 :cc-below jmp-cc-rel-imm8 48 83 e8 2a ~ 0x2a :rax sub-reg64-imm8 ~ ASCII lowercase a 7c 0d ~ 0x0d :cc-less jmp-cc-rel-imm8 48 83 c0 0a ~ 0x0a :rax add-reg64-imm8 48 83 f8 10 ~ 0x10 :rax cmp-reg64-imm8 72 02 ~ 0x02 :cc-below jmp-cc-rel-imm8 eb 01 ~ 0x01 jmp-rel-imm8 c3 ~ ret ~ These are the error handler routines. 48 be ae 01 00 08 00 00 00 00 ~ 0x00000000080001ae :rsi mov-reg64-imm64 48 ba 0e 00 00 00 00 00 00 00 ~ 0x000000000000000e :rdx mov-reg64-imm64 eb 2a ~ 0x2a jmp-rel-imm8 48 be c8 01 00 08 00 00 00 00 ~ 0x00000000080001c8 :rsi mov-reg64-imm64 48 ba 10 00 00 00 00 00 00 00 ~ 0x0000000000000010 :rdx mov-reg64-imm64 eb 14 ~ 0x14 jmp-rel-imm8 48 be bc 01 00 08 00 00 00 00 ~ 0x00000000080001bc :rsi mov-reg64-imm64 48 ba 0c 00 00 00 00 00 00 00 ~ 0x000000000000000c :rdx mov-reg64-imm64 48 c7 c0 01 00 00 00 ~ 0x00000001 :rax mov-reg64-imm32 ~ syscall number for sys-write 48 c7 c7 02 00 00 00 ~ 0x00000002 :rdi mov-reg64-imm32 ~ file descriptor 2 is stderr 0f 05 ~ syscall 48 c7 c0 3c 00 00 00 ~ 0x0000003c :rax mov-reg64-imm32 ~ syscall number for sys-exit 48 c7 c7 01 00 00 00 ~ 0x00000001 :rdi mov-reg64-imm32 ~ exit code 0f 05 ~ syscall ~ These are the message strings. ~ String literal with null terminator: "Invalid byte." 49 6e 76 61 6c 69 64 20 62 79 74 65 2e 00 ~ String literal with null terminator: "Read error." 52 65 61 64 20 65 72 72 6f 72 2e 00 ~ String literal with null terminator: "Unexpected EOF." 55 6e 65 78 70 65 63 74 65 64 20 45 4f 46 2e 00 ~ This is a buffer that's zero in the ELF, but is written to at runtime ~ and used as a variable. 00 00 00 00 00 00 00 00 ~ This is the end of the hex dump.