The topic came up in another thread about the issue of comparing Strelka to Fruit vs. comparing Rybka 1.0 to Fruit. I am doing some disassembling of Rybka 1.0, so I will post the assembly that is equivalent to the last piece of code I had in Fruit. Just to let you know, this is by no means complete. I have filled in most of the function names and some of the variable names, but there is a lot left to do. This is just the result of a few day's work, more will come later.
Code: Select all
.text:0040BCA0 start_search proc near ; CODE XREF:
start_go+35F p
.text:0040BCA0
.text:0040BCA0 var_44C = dword ptr -44Ch
.text:0040BCA0 var_440 = dword ptr -440h
.text:0040BCA0 undo = dword ptr -40h
.text:0040BCA0 var_8 = dword ptr -8
.text:0040BCA0 num_moves = dword ptr -4
.text:0040BCA0
.text:0040BCA0 push ebp
.text:0040BCA1 mov ebp, esp
.text:0040BCA3 sub esp, 440h
.text:0040BCA9 push ebx
.text:0040BCAA push esi
.text:0040BCAB push edi
.text:0040BCAC push offset dword_669C60
.text:0040BCB1 mov dword_667A0C, -500
.text:0040BCBB mov dword_667A10, 500
.text:0040BCC5 call evaluate
.text:0040BCCA add esp, 4
.text:0040BCCD test al, al
.text:0040BCCF jz short loc_40BD25
.text:0040BCD1 mov ecx, dword_669C6C
.text:0040BCD7 mov eax, dword_669C68
.text:0040BCDC not ecx
.text:0040BCDE push ecx
.text:0040BCDF not eax
.text:0040BCE1 push eax
.text:0040BCE2 push offset list_root
.text:0040BCE7 call gen_evasions
.text:0040BCEC mov ecx, list_root
.text:0040BCF2 add esp, 12
.text:0040BCF5 xor eax, eax
.text:0040BCF7 test ecx, ecx
.text:0040BCF9 jz short loc_40BD15
.text:0040BCFB jmp short loc_40BD00
.text:0040BCFB ;
---------------------------------------------------------------------------
.text:0040BCFD align 10h
.text:0040BD00
.text:0040BD00 loc_40BD00: ; CODE XREF:
start_search+5B j
.text:0040BD00 ; start_search+73 j
.text:0040BD00 mov list_root[eax*4], ecx
.text:0040BD07 mov ecx, dword_66BC78[eax*8]
.text:0040BD0E add eax, 1
.text:0040BD11 test ecx, ecx
.text:0040BD13 jnz short loc_40BD00
.text:0040BD15
.text:0040BD15 loc_40BD15: ; CODE XREF:
start_search+59 j
.text:0040BD15 mov list_root[eax*4], 0
.text:0040BD20 jmp loc_40BDC2
.text:0040BD25 ;
---------------------------------------------------------------------------
.text:0040BD25
.text:0040BD25 loc_40BD25: ; CODE XREF:
start_search+2F j
.text:0040BD25 mov edx, dword_667B9C
.text:0040BD2B mov eax, dword_667B98
.text:0040BD30 mov ecx, dword_667B94
.text:0040BD36 push edx
.text:0040BD37 mov edx, dword_667B90
.text:0040BD3D push eax
.text:0040BD3E push ecx
.text:0040BD3F push edx
.text:0040BD40 push offset dword_66C070
.text:0040BD45 mov eax, offset list_root
.text:0040BD4A call gen_captures
.text:0040BD4F xor esi, esi
.text:0040BD51 add esp, 20
.text:0040BD54 cmp list_root, esi
.text:0040BD5A jz short loc_40BD6D
.text:0040BD5C lea esp, [esp+0]
.text:0040BD60
.text:0040BD60 loc_40BD60: ; CODE XREF:
start_search+CB j
.text:0040BD60 add esi, 1
.text:0040BD63 cmp list_root[esi*4], 0
.text:0040BD6B jnz short loc_40BD60
.text:0040BD6D
.text:0040BD6D loc_40BD6D: ; CODE XREF:
start_search+BA j
.text:0040BD6D mov eax, dword_669C6C
.text:0040BD72 mov ecx, dword_669C68
.text:0040BD78 push -1
.text:0040BD7A push -1
.text:0040BD7C push -1
.text:0040BD7E push eax
.text:0040BD7F push ecx
.text:0040BD80 lea edx, [ebp+var_440]
.text:0040BD86 push edx
.text:0040BD87 call gen_quiet_moves
.text:0040BD8C mov eax, [ebp+var_440]
.text:0040BD92 add esp, 24
.text:0040BD95 xor ecx, ecx
.text:0040BD97 test eax, eax
.text:0040BD99 jz short loc_40BDB5
.text:0040BD9B lea edx, ds:66BC70h[esi*4]
.text:0040BDA2
.text:0040BDA2 loc_40BDA2: ; CODE XREF:
start_search+113 j
.text:0040BDA2 add ecx, 1
.text:0040BDA5 mov [edx], eax
.text:0040BDA7 mov eax, [ebp+ecx*4+var_440]
.text:0040BDAE add edx, 4
.text:0040BDB1 test eax, eax
.text:0040BDB3 jnz short loc_40BDA2
.text:0040BDB5
.text:0040BDB5 loc_40BDB5: ; CODE XREF:
start_search+F9 j
.text:0040BDB5 add ecx, esi
.text:0040BDB7 mov list_root[ecx*4], 0
.text:0040BDC2
.text:0040BDC2 loc_40BDC2: ; CODE XREF:
start_search+80 j
.text:0040BDC2 mov esi, list_root
.text:0040BDC8 xor edi, edi
.text:0040BDCA test esi, esi
.text:0040BDCC mov [ebp+num_moves], edi
.text:0040BDCF jz short loc_40BE4C
.text:0040BDD1 mov [ebp+num_moves], offset list_root
.text:0040BDD8
.text:0040BDD8 loc_40BDD8: ; CODE XREF:
start_search+1A7 j
.text:0040BDD8 lea eax, [ebp+undo]
.text:0040BDDB push eax
.text:0040BDDC push esi
.text:0040BDDD call make_move
.text:0040BDE2 push offset pos_info_entry
.text:0040BDE7 call evaluate
.text:0040BDEC mov ecx, dword_667C20
.text:0040BDF2 lea edx, ds:0[ecx*8]
.text:0040BDF9 mov ecx, offset dword_667BF8
.text:0040BDFE sub ecx, edx
.text:0040BE00 mov eax, [ecx]
.text:0040BE02 mov ecx, [ecx+4]
.text:0040BE05 and eax, pos_info_entry
.text:0040BE0B and ecx, dword_669C84
.text:0040BE11 add esp, 0Ch
.text:0040BE14 or eax, ecx
.text:0040BE16 jnz short loc_40BE1C
.text:0040BE18 mov bl, 1
.text:0040BE1A jmp short loc_40BE1E
.text:0040BE1C ;
---------------------------------------------------------------------------
.text:0040BE1C
.text:0040BE1C loc_40BE1C: ; CODE XREF:
start_search+176 j
.text:0040BE1C xor bl, bl
.text:0040BE1E
.text:0040BE1E loc_40BE1E: ; CODE XREF:
start_search+17A j
.text:0040BE1E lea eax, [ebp+undo]
.text:0040BE21 push eax
.text:0040BE22 push esi
.text:0040BE23 call unmake_move
.text:0040BE28 add esp, 8
.text:0040BE2B test bl, bl
.text:0040BE2D jz short loc_40BE39
.text:0040BE2F mov list_root[edi*4], esi
.text:0040BE36 add edi, 1 ; num_moves++
.text:0040BE39
.text:0040BE39 loc_40BE39: ; CODE XREF:
start_search+18D j
.text:0040BE39 mov eax, [ebp+num_moves]
.text:0040BE3C mov esi, [eax+4]
.text:0040BE3F add eax, 4 ; i++
.text:0040BE42 test esi, esi ; list_root[i].move!=0
.text:0040BE44 mov [ebp+num_moves], eax
.text:0040BE47 jnz short loc_40BDD8
.text:0040BE49 mov [ebp+num_moves], edi
.text:0040BE4C
.text:0040BE4C loc_40BE4C: ; CODE XREF:
start_search+12F j
.text:0040BE4C xor esi, esi
.text:0040BE4E cmp edi, 1 ; if (num_moves <= 1)
.text:0040BE51 mov list_root[edi*4], esi ;
list_root[num_moves].move = 0
.text:0040BE58 ja short loc_40BE64
.text:0040BE5A mov G_max_depth, 4 ; max_depth = 4;
.text:0040BE64
.text:0040BE64 loc_40BE64: ; CODE XREF:
start_search+1B8 j
.text:0040BE64 push esi
.text:0040BE65 push offset dword_667A28
.text:0040BE6A call setjmp
.text:0040BE6F add esp, 8
.text:0040BE72 test eax, eax ; if
(setjmp(jmp_buffer) != 0) return;
.text:0040BE74 jz short loc_40BE87
.text:0040BE76 mov eax, offset byte_664E08
.text:0040BE7B call sub_4092E0
.text:0040BE80 pop edi
.text:0040BE81 pop esi
.text:0040BE82 pop ebx
.text:0040BE83 mov esp, ebp
.text:0040BE85 pop ebp
.text:0040BE86 retn
.text:0040BE87 ;
---------------------------------------------------------------------------
.text:0040BE87
.text:0040BE87 loc_40BE87: ; CODE XREF:
start_search+1D4 j
.text:0040BE87 call ds:GetTickCount ; start_timer
.text:0040BE8D mov start_time, eax
.text:0040BE92 mov eax, dword_66C490
.text:0040BE97 add eax, 1 ; All of this
stuff is trans_inc_date
.text:0040BE9A and eax, 3
.text:0040BE9D mov ecx, eax
.text:0040BE9F cmp ecx, esi
.text:0040BEA1 mov dword_66C490, eax
.text:0040BEA6 jge short loc_40BEAB
.text:0040BEA8 add ecx, 4
.text:0040BEAB
.text:0040BEAB loc_40BEAB: ; CODE XREF:
start_search+206 j
.text:0040BEAB add ecx, 1
.text:0040BEAE shl ecx, 8
.text:0040BEB1 mov dword_66C498, ecx
.text:0040BEB7 lea ecx, [eax-1]
.text:0040BEBA cmp ecx, esi
.text:0040BEBC jge short loc_40BEC1
.text:0040BEBE add ecx, 4
.text:0040BEC1
.text:0040BEC1 loc_40BEC1: ; CODE XREF:
start_search+21C j
.text:0040BEC1 add ecx, 1
.text:0040BEC4 shl ecx, 8
.text:0040BEC7 mov dword_66C49C, ecx
.text:0040BECD lea ecx, [eax-2]
.text:0040BED0 cmp ecx, esi
.text:0040BED2 jge short loc_40BED7
.text:0040BED4 add ecx, 4
.text:0040BED7
.text:0040BED7 loc_40BED7: ; CODE XREF:
start_search+232 j
.text:0040BED7 add ecx, 1
.text:0040BEDA shl ecx, 8
.text:0040BEDD add eax, -3
.text:0040BEE0 cmp eax, esi
.text:0040BEE2 mov dword_66C4A0, ecx
.text:0040BEE8 jge short loc_40BEED
.text:0040BEEA add eax, 4
.text:0040BEED
.text:0040BEED loc_40BEED: ; CODE XREF:
start_search+248 j
.text:0040BEED add eax, 1
.text:0040BEF0 shl eax, 8
.text:0040BEF3 mov dword_66C4A4, eax
.text:0040BEF8 xor eax, eax
.text:0040BEFA lea ebx, [ebx+0]
.text:0040BF00
.text:0040BF00 loc_40BF00: ; CODE XREF:
start_search+274 j
.text:0040BF00 mov killer1[eax], esi ; (Pos_info + i)->killer1 = 0;
.text:0040BF06 mov killer2[eax], esi ; (Pos_info + i)->killer2 = 0;
.text:0040BF0C add eax, 32
.text:0040BF0F cmp eax, 8192
.text:0040BF14 jb short loc_40BF00
.text:0040BF16 mov eax, 256
.text:0040BF1B mov ecx, 768
.text:0040BF20 mov edi, offset History
.text:0040BF25 rep stosd ;
memset(History, 256, 12 * 64 * sizeof(int));
.text:0040BF27 mov eax, dword_667C40
.text:0040BF2C and eax, dword_66C488
.text:0040BF32 mov ecx, dword_667C44
.text:0040BF38 shl eax, 4
.text:0040BF3B add eax, dword_66C480
.text:0040BF41 cmp [eax], ecx
.text:0040BF43 jnz short loc_40BF4F
.text:0040BF45 movzx edx, word ptr [eax+4]
.text:0040BF49 mov dword_66C478, edx
.text:0040BF4F
.text:0040BF4F loc_40BF4F: ; CODE XREF:
start_search+2A3 j
.text:0040BF4F cmp [eax+10h], ecx
.text:0040BF52 jnz short loc_40BF5E
.text:0040BF54 movzx edx, word ptr [eax+14h]
.text:0040BF58 mov dword_66C478, edx
.text:0040BF5E
.text:0040BF5E loc_40BF5E: ; CODE XREF:
start_search+2B2 j
.text:0040BF5E cmp [eax+20h], ecx
.text:0040BF61 jnz short loc_40BF6D
.text:0040BF63 movzx edx, word ptr [eax+24h]
.text:0040BF67 mov dword_66C478, edx
.text:0040BF6D
.text:0040BF6D loc_40BF6D: ; CODE XREF:
start_search+2C1 j
.text:0040BF6D cmp [eax+30h], ecx
.text:0040BF70 jnz short loc_40BF7B
.text:0040BF72 movzx eax, word ptr [eax+34h]
.text:0040BF76 mov dword_66C478, eax
.text:0040BF7B
.text:0040BF7B loc_40BF7B: ; CODE XREF:
start_search+2D0 j
.text:0040BF7B mov eax, [ebp+num_moves]
.text:0040BF7E cmp eax, 2
.text:0040BF81 jb loc_40C039
.text:0040BF87 add eax, -1
.text:0040BF8A mov [ebp+var_8], eax
.text:0040BF8D js loc_40C039
.text:0040BF93
.text:0040BF93 loc_40BF93: ; CODE XREF:
start_search+393 j
.text:0040BF93 lea ebx, ds:0[eax*4]
.text:0040BF9A mov edi, list_root[ebx]
.text:0040BFA0 cmp edi, dword_66C478
.text:0040BFA6 lea edx, dword_66C074[ebx]
.text:0040BFAC jnz short loc_40BFB5
.text:0040BFAE mov ecx, 7FFFFFFFh
.text:0040BFB3 jmp short loc_40BFE1
.text:0040BFB5 ;
---------------------------------------------------------------------------
.text:0040BFB5
.text:0040BFB5 loc_40BFB5: ; CODE XREF:
start_search+30C j
.text:0040BFB5 mov ecx, edi
.text:0040BFB7 and ecx, 63
.text:0040BFBA mov ecx, dword_667A90[ecx*4]
.text:0040BFC1 test ecx, ecx
.text:0040BFC3 jz short loc_40BFDF
.text:0040BFC5 mov esi, edi
.text:0040BFC7 shr esi, 6
.text:0040BFCA and esi, 63
.text:0040BFCD shl ecx, 4
.text:0040BFD0 sub ecx, dword_667A90[esi*4]
.text:0040BFD7 add ecx, 2147483391
.text:0040BFDD jmp short loc_40BFE1
.text:0040BFDF ;
---------------------------------------------------------------------------
.text:0040BFDF
.text:0040BFDF loc_40BFDF: ; CODE XREF:
start_search+323 j
.text:0040BFDF xor ecx, ecx
.text:0040BFE1
.text:0040BFE1 loc_40BFE1: ; CODE XREF:
start_search+313 j
.text:0040BFE1 ; start_search+33D j
.text:0040BFE1 cmp ecx, [edx]
.text:0040BFE3 mov esi, eax
.text:0040BFE5 jnb short loc_40C01F
.text:0040BFE7 mov eax, ebx
.text:0040BFE9 lea esp, [esp+0]
.text:0040BFF0
.text:0040BFF0 loc_40BFF0: ; CODE XREF:
start_search+37A j
.text:0040BFF0 mov ebx, dword_66BC74[eax]
.text:0040BFF6 mov edx, [edx]
.text:0040BFF8 mov list_root[eax], ebx
.text:0040BFFE mov dword_66C070[eax], edx
.text:0040C004 add esi, 1
.text:0040C007 lea eax, ds:0[esi*4]
.text:0040C00E cmp ecx, dword_66C074[eax]
.text:0040C014 lea edx, dword_66C074[eax]
.text:0040C01A jb short loc_40BFF0
.text:0040C01C mov eax, [ebp+var_8]
.text:0040C01F
.text:0040C01F loc_40C01F: ; CODE XREF:
start_search+345 j
.text:0040C01F sub eax, 1
.text:0040C022 mov list_root[esi*4], edi
.text:0040C029 mov dword_66C070[esi*4], ecx
.text:0040C030 mov [ebp+var_8], eax
.text:0040C033 jns loc_40BF93
.text:0040C039
.text:0040C039 loc_40C039: ; CODE XREF:
start_search+2E1 j
.text:0040C039 ; start_search+2ED j
The interesting thing that I found is that for this piece of code, Rybka 1.0 is
similar to Fruit than Strelka. Here are the differences:
--Something very strange: whereas in Strelka a failed setjmp call simply results in a return, in Rybka 1.0 it involves a function call, like in Fruit (there it is search_update_current()). The weird part is, it appears to be calling parse_position(). That is what the "call sub_4092E0" is for. Why would Rybka 1.0 be parsing the position after a setjmp call?
--depth is limited to 4 when there's only 1 legal move (commented out in Strelka, as noted in the other thread).
--I noted earlier that the history initialization was different. Strelka and Rybka 1.0 are the same here, using memset(History, 256, 12 * 64 * sizeof(int)); But what I didn't notice is, 256 is out of range for an unsigned char. So that code is the same as Fruit's memset(History, 0, 12 * 64 * sizeof(int)); Why would Rybka 1.0 have 256? Is it the optimizer gone wild, or a deliberate attempt at obfuscation?
