vmp里面只有1个逻辑运算指令 not_not_and 设这条指令为P
P(a,b) = ~a & ~b

这条指令的神奇之处就是能模拟 not and or xor 4条常规的逻辑运算指令
怕忘记了，直接给出公式，后面的数字指需要几次P运算

not(a) = P(a,a) 1
and(a,b) = P(P(a,a),P(b,b)) 3
or(a,b) = P(P(a,b),P(a,b)) 2
xor(a,b) = P(P(P(a,a),P(b,b)),P(a,b)) 5

上面的次数应该是最少需要的次数了，当然也可以展开，那样就更加复杂了
vmp用1条指令模拟了4条指令，因此逆向起来比较复杂，如果中间夹杂垃圾运算，那么工程量非同小可
下面来证明一下上面4条等式

not(a) = ~a = ~a & ~a = P(a,a)
and(a,b) = a & b = ~(~a) & ~(~b) = P(not(a),not(b)) = P(P(a,a),P(b,b))
or(a,b) = a | b = ~(~(a|b)) = ~(~a & ~b) = ~P(a,b) = P(P(a,b),P(a,b))
xor(a,b) = ~a & b | a & ~b = ~(~(~a & b | a & ~b)) = ~(~(~a & b) & ~(a & ~b)) = ~((a | ~b) & (~a | b)) = ~(1 | 1 | a & b | ~a & ~b) = ~(a & b) & ~(~a & ~b) = P(and(a,b),P(a,b)) = P(P(P(a,a),P(b,b)),P(a,b))

上面的xor是最复杂的，不过简化后也只需要5次运算就可以实现了

至于eflag，eflag是根据结果来定的，由于都是逻辑运算，所以最后取一下eflag即可

在某修改版的vm中，还可以看到另一个强大的指令 not_not_or 设这条指令为Q
Q(a,b) = ~a | ~b

同样，这一条指令可以模拟4条常规的逻辑运算指令
怕忘记了，直接给出公式，后面数字表示需要几次Q运算

not(a) = Q(a,a) 1
and(a,b) = Q(Q(a,b),Q(a,b)) 2
or(a,b) = Q(Q(a,a),Q(b,b)) 3
xor(a,b) = Q(Q(Q(a,a),b),Q(a,Q(b,b))) 5

基本和上面P指令相同，效率没什么变化
只对最复杂的xor证明一下，以防忘记

xor(a,b) = ~a & b | a & ~b = ~(~(~a & b | a & ~b)) = ~(~(~a & b) & ~(a & ~b)) = ~((~(~a) | ~b) & (~a | ~(~b))) = ~(~(~a) | ~b) | ~(~a | ~(~b)) = Q(Q(not(a),b),Q(a,not(b))) = Q(Q(Q(a,a),b),Q(a,Q(b,b)))

实在太难了，完全搞不定啊

BINARY GAMES

forgot

--------------------------------------------------------------------------------

I. SWAP_XOR(x, y)

x = A
y = B

1) x ^= y

x = A ^ B // NOTE: A != B

2) y ^= x

y = B ^ x = B ^ A ^ B = A

3) x ^= y

x = A ^ B ^ y = A ^ B ^ A = B

--------------------------------------------------------------------------------

II. SWAP_ADDSUB(x, y)

x = A
y = B

1) x += y

x = A + B

2) y -= x

y = B - (A + B) = -A

3) x += y // subtration is slower, change y sign next step

x = A + B - A = B

4) y = ~y + 1

y = A

--------------------------------------------------------------------------------

III. NEG(x)

We assume x + y = 0

x + y - 1 = -1 = 11111111...111111111b

x = ~(y - 1)

--------------------------------------------------------------------------------

IV. XOR(x, y)

x = A
y = B

m = x | y
n = x & y

m - n = x ^ y

--------------------------------------------------------------------------------

V. ALIGN(x, k)

k = pow(2, n) = 00...........10000000000000000.........0

We should make a mask to remove last bits of X

V. ALIGN(x, k)

k = pow(2, n) = 00...........10000000000000000.........0

We should make a mask to remove last bits of X

NEG(k) = ~k + 1
e.g. 000010000 -> 111101111 -> 111110000 -> mask

m = x + k - 1 // do nothing if x is aligned
n = ~k + 1

ALIGN(x, k) = m & n