By guessing the filename on 's FTP we can download the source code to assist us with the reverse engineering process: ĭon't worry, I won't bother you with learning reverse engineering here (we will save that up for another article). By knowing that Prime95 27.7 is used and that it's actually open source, this is just too easy. The application's strings also reveal that most of the configuration options defined by prime.ini and local.ini are still supported. By searching through the strings of the application we can also find that the Prime95 version used by Intel is "27.7", one of the first to make use of AVX instructions. I will dive into that later on, but let's analyze the executable first. That immediately raises the question why this benchmark is only compatible with Intel CPUs? Prime95 in its latest versions even brings a rudimentary Zen support to the table, so the benchmark itself can't be the real reason. Opening the temporary benchmark executable with IDA reveals the following strings when searching for mersenneĪ search for "mersenne" reveals that this is indeed the well known Prime95 at work here, at least a very basic command line version of it. We don't even need to reverse anything at this point, we will just have a look at the strings inside the benchmark executable: But that doesn't hinder us to run a reverse engineering tool (Ollydbg or IDA will do). The file's properties show that it was digitally signed to avoid modification. So "p95-bench", huh? Could this be Prime95? Let's grab the file during a benchmark run and have a look at it. After the benchmark run these files will be deleted again.
The ProgramData folder and the temporary benchmark executables are marked as "hidden", so be sure to enable the setting to show hidden files in Windows Explorer to view them. It can be found in a temporary folder called: C:\ProgramData\Intel\Intel Extreme Tuning Utility\Temp This file is the actual benchmark that is being called 20 times for the whole run, once for each movement of the blue process bar. The selected row shows the creation of a file called p95-bench(32-bit).exe or p95-bench(64-bit).exe depending on the OS and detected hardware. ProcessMonitor monitoring PerfTune.exe, the main executable of XTU
0 kommentar(er)
