Does Replacing Instructions that Do Nothing with NOPs Change Anything?

[u/ShadowGuyinRealLife]

Suppose in the executable, instructions N to N+6 do some load instructions from memory, then N+7 to N+30 are some integer operations like add, subtract, multiply, bitwise operations and so on. the results are not stored to memory. Then Instruction N+31 to N+37 loads new values in the registers and none of the results of the previous calculations do anything. A different version of the executable has instructions N to N+30 all be "NOP" and N+31 to N+37 are the same as before. Does anything change? My inspiration for this is the game Mario 64 had been dissected and if you look at the assembly of the NTCS version, there are plenty of instructions that do some calculations that aren't used and some weird things like loading from the same address to the same register when the register's value could not possibly be changed. At the same time these instructions couldn't outright be removed or the alignment of all the JMPs would be thrown off. My friend said perhaps some NOPs might be done with a lower power consumption than some of the multiplication instructions, but otherwise if the later instructions don't use the results of the extraneous instructions and are unaffected by their flags nothing should change.

[u/nuclear_splines]

Well, it depends on what you mean by "change anything".

• If you perform a calculation and throw the results away, that should be equivalent to not performing the calculation in abstract logic land

• If you read a value from memory it may be placed in cache, or could be kept around in cache for longer, even if the value isn't used. This could incidentally change the performance of future instructions

• Depending on the hardware architecture, some instructions may take much longer to run than others. If the rest of the program is timing-sensitive, replacing 'unused' instructions with NOPs could upset that timing

• Changing the instructions will of course change the bytes of the executable and its hash, which could theoretically impact behavior (such as copy protection checking whether the program has been altered)

[u/ShadowGuyinRealLife → u/nuclear_splines]

Thanks for answering. I guess I wasn't too specific

*If you perform a calculation and throw the results away, that should be equivalent to not performing the calculation in abstract logic land

This is what I meant by "do nothing" instructions, just preforming calculations that are thrown away.

*Depending on the hardware architecture, some instructions may take much longer to run than others. If the rest of the program is timing-sensitive, replacing 'unused' instructions with NOPs could upset that timing

Thanks. I was sort of looking for side effects like this. The only thing my friend could think of was power consumption. And I was like "hmmm... surely depending on the hardware there are others right?"

*Changing the instructions will of course change the bytes of the executable and its hash, which could theoretically impact behavior (such as copy protection checking whether the program has been altered)

In this case the instructions of the executable are being both used as instructions, and as data for something that reads it (in this case something that tries to read the bytes of the executable and its hash). The thought in my head was parts of the executable acting just as instructions. So you're right anything that reads the executable as data will be altered.

Since I was mainly looking for side effects while executing the calculations themselves, if I knew of this possibility but not of the others, I probably would have asked "what if the calculations that are thrown out are replaced by NOPs and anything that reads the instructions in the executable as data altered to take in consideration the alteration while keeping the executable the same size." But as asked, you did have an answer so thank you.

I just noticed Reddit does very weird things with quotes.

[u/nuclear_splines → u/ShadowGuyinRealLife]

what if the calculations that are thrown out are replaced by NOPs and anything that reads the instructions in the executable as data altered to take in consideration the alteration while keeping the executable the same size.

As an aside, this is exactly what malware analysts and pirates do. Malware often hashes regions of its own text segment to see whether they've been altered (such as with software breakpoints or instructions NOPed out) and changes its behavior when under observation. So the analyst needs to identify those checks and NOP them out, too. Likewise, commercial software may check for alterations as part of copy protection or anti-cheat, so the pirates play a cat and mouse game identifying those checks and rewriting them.