Extracting Floating-Point Constants from Binaries

Extracting Floating-Point Constants from Binaries

This guide covers techniques for systematically extracting and decoding floating-point constants from compiled binaries.

Where Constants Live

.rodata Section

Most floating-point constants are stored in the read-only data section:

objdump -s -j .rodata ./binary

This outputs hex dumps like:

Contents of section .rodata:
 402000 00000000 0000f03f 00000000 00002440  .......?......$@
 402010 0000803f 00004040 cdcc4c3f 00000000  ...?..@@..L?....

.data Section

Mutable initialized data may also contain constants:

objdump -s -j .data ./binary

Inline in Instructions

Some constants are embedded directly in SSE/AVX instructions or loaded via mov instructions.

Decoding Floating-Point Values

IEEE 754 Single Precision (32-bit float)

Format: 1 sign bit, 8 exponent bits, 23 mantissa bits

import struct

def decode_float(hex_string):
    """Decode 4-byte hex string to float (little-endian)"""
    bytes_le = bytes.fromhex(hex_string)
    return struct.unpack('<f', bytes_le)[0]

# Examples
decode_float('0000803f')  # 1.0
decode_float('00004040')  # 3.0
decode_float('cdcc4c3f')  # 0.8 (approximately)
decode_float('00000000')  # 0.0
decode_float('0000803f')  # 1.0
decode_float('000080bf')  # -1.0

IEEE 754 Double Precision (64-bit double)

Format: 1 sign bit, 11 exponent bits, 52 mantissa bits

def decode_double(hex_string):
    """Decode 8-byte hex string to double (little-endian)"""
    bytes_le = bytes.fromhex(hex_string)
    return struct.unpack('<d', bytes_le)[0]

# Examples
decode_double('0000000000002440')  # 10.0
decode_double('0000000000000000')  # 0.0
decode_double('000000000000f03f')  # 1.0
decode_double('182d4454fb210940')  # 3.14159265358979

Common Float Patterns

Frequently Used Values

Recognizing Patterns

1. Small positive floats: Start with 3f (exponent ~127)
2. Negative values: High bit set in last byte (e.g., bf instead of 3f)
3. Values 2-4: Start with 40 (exponent ~128)
4. Values near 255: Start with 43 for float

Systematic Extraction Script

#!/usr/bin/env python3
"""Extract and decode all floating-point constants from a binary."""

import struct
import subprocess
import re

def get_rodata(binary_path):
    """Extract .rodata section hex dump."""
    result = subprocess.run(
        ['objdump', '-s', '-j', '.rodata', binary_path],
        capture_output=True, text=True
    )
    return result.stdout

def parse_hex_dump(dump):
    """Parse objdump hex output into bytes."""
    data = bytearray()
    for line in dump.split('\n'):
        # Match lines like: " 402000 00000000 0000f03f..."
        match = re.match(r'\s*[0-9a-f]+\s+([0-9a-f ]+)', line)
        if match:
            hex_part = match.group(1).replace(' ', '')[:32]  # 16 bytes max
            if hex_part:
                data.extend(bytes.fromhex(hex_part))
    return bytes(data)

def find_floats(data, base_addr=0):
    """Scan data for valid-looking floats."""
    results = []
    for i in range(0, len(data) - 3, 4):
        chunk = data[i:i+4]
        try:
            value = struct.unpack('<f', chunk)[0]
            # Filter for "reasonable" values
            if abs(value) < 1e10 and abs(value) > 1e-10 or value == 0:
                results.append((base_addr + i, chunk.hex(), value))
        except:
            pass
    return results

def find_doubles(data, base_addr=0):
    """Scan data for valid-looking doubles."""
    results = []
    for i in range(0, len(data) - 7, 8):
        chunk = data[i:i+8]
        try:
            value = struct.unpack('<d', chunk)[0]
            if abs(value) < 1e10 and abs(value) > 1e-10 or value == 0:
                results.append((base_addr + i, chunk.hex(), value))
        except:
            pass
    return results

if __name__ == '__main__':
    import sys
    binary = sys.argv[1] if len(sys.argv) > 1 else './mystery'

    dump = get_rodata(binary)
    data = parse_hex_dump(dump)

    print("Potential float constants:")
    for addr, hex_val, value in find_floats(data):
        print(f"  0x{addr:08x}: {hex_val} = {value}")

    print("\nPotential double constants:")
    for addr, hex_val, value in find_doubles(data):
        print(f"  0x{addr:08x}: {hex_val} = {value}")

Cross-Referencing with Disassembly

After extracting constants, find where they're used:

# Find references to a specific address
objdump -d ./binary | grep "402000"

# Look for SSE load instructions
objdump -d ./binary | grep -E "(movss|movsd|movaps|movapd)"

SSE Instruction Patterns

; Loading single float from memory
movss  xmm0, DWORD PTR [rip+0x1234]  ; Loads 32-bit float

; Loading double from memory
movsd  xmm0, QWORD PTR [rip+0x1234]  ; Loads 64-bit double

; Loading packed floats
movaps xmm0, XMMWORD PTR [rip+0x1234]  ; Loads 4 floats

Determining float vs double

Key indicators in assembly:

Verifying Extracted Values

Once constants are identified, verify by:

1. Creating a test program using those exact values
2. Comparing specific outputs pixel-by-pixel
3. Using GDB to inspect values at runtime:

gdb ./binary
(gdb) break main
(gdb) run
(gdb) x/f 0x402000   # Print as float
(gdb) x/g 0x402000   # Print as double