Hexspeak&leetspeak

在看一些开源项目的时候,经常会遇到一些奇怪的 magic numbers,比如 0xdeedbeef,它们经常出现,但是有什么含义呢?

wiki 上对 Hexspeak 的解释如下:

Hexspeak, like leetspeak, is a novelty form of variant English spelling using the hexadecimal digits. Created by programmers as memorable magic numbers, hexspeak words can serve as a clear and unique identifier with which to mark memory or data.

简而言之,hexspeak,就是一种程序员发明的,用 16 进制数来表达的一种变体的英文拼写。

翻译规则

16 进制的书写由0123456789ABCDEF15 个字符来完成,仅仅使用ABCDEF几个字母就已经可以拼写出很多单词了。剩余的0123456789可以将它们转化成对应的字母,比如:

  • 0可以当作字母O
  • 1可以当作字母L或者I
  • 5可以当作字母S,
  • 7可以当作字母T,
  • 12可以当作字母R,
  • 6或者9可以当作字母G或者g,
  • 5可以当作字母S,
  • 248则可使用谐音,如toforate

通过这种方式就可以表达出更多含义了。

常见的 magic numbers

许多计算机处理器、操作系统和调试器都会使用幻数,尤其是将其作为调试值。下面是 wiki 中收录的一些常见幻数:

Code Description
0x0000000FF1CE (“office”) is used as the last part of product codes (GUID) for Microsoft Office components (visible in registry under the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall registry key).
0x00BAB10C (“über (ooba) block”) is used as the magic number for the ZFS uberblock.
0x1BADB002 (“1 bad boot”[1]) Multiboot header magic number.[2]
0x4B1D (“forbid”) was a password in some calibration consoles for developers to peer deeper into control registers outside the normal calibration memory range.[citation needed]
0x8BADF00D (“ate bad food”) is used by Apple in iOS crash reports, when an application takes too long to launch, terminate, or respond to system events.[3]
0xABADBABE (“a bad babe”) was/is used by Microsoft’s Windows 7 to trigger a debugger break-point, probably when a USB device is attached[4]
0xB105F00D (“BIOS food”) is the value of the low bytes of last four registers on ARM PrimeCell compatible components (the component_id registers), used to identify correct behaviour of a memory-mapped component.
0xB16B00B5 (“big boobs”) was required by Microsoft’s Hyper-V hypervisor to be used by Linux guests as their “guest signature”.[5] One proposal suggested changing it to 0x0DEFACED (“defaced”).[6] But in actuality, it was initially changed to decimal and then replaced entirely.[7]
0x0B00B135 (“boobies”) was likewise required by Microsoft’s Hyper-V hypervisor to be used by a user of XEN as their user id.[8] It was removed on January 22, 2010.[9]
0xBAAAAAAD (“baaaaaad”) is used by Apple’s iOS exception report to indicate that the log is a stackshot of the entire system, not a crash report.[10]
0xBAADF00D (“bad food”) is used by Microsoft’s LocalAlloc(LMEM_FIXED) to indicate uninitialised allocated heap memory when the debug heap is used.[11]
0xBAD22222 (“bad too repeatedly”) is used by Apple’s iOS exception log to indicate that a VoIP application has been terminated by iOS because it resumed too frequently.[10]
0xBADDCAFE (“bad cafe”) is used by Libumem to indicate uninitialized memory area.
0xCAFEB0BA (“cafe boba”) is used by datp as canned return value for QKit MFCC keyword detection for Host GUI development since his colleague likes coffee (and maybe boba, too).
0xB0BABABE (“boba babe”) is used by pton as Host GUI Ack to QKit MFCC keyword detection response.
0xBEEFBABE (“beef babe”) is used by the 1997 video game Frogger to detect a stack buffer overflow.
0xB000 0xDEAD (“boo dead”) was displayed by PA-RISC based HP 3000 and HP 9000 computers upon encountering a “system halt” (aka “low level halt”).[12]
0xC00010FF (“cool off”) is used by Apple in iOS crash reports, when application was killed in response to a thermal event.[3]
C15C:0D06:F00D (“cisco dog food”) used in the IPv6 address of www.cisco.com on World IPv6 Day. “Dog food” refers to Cisco eating its own dog food with IPv6.
0xCAFEBABE (“cafe babe”) is used by Plan 9’s libc as a poison value for memory pools.[13] It is also used by Mach-O to identify Universal object files, and by the Java programming language to identify Java bytecode class files. It was originally created by NeXTSTEP developers as a reference to the baristas at Peet’s Coffee & Tea.[14]
0xCAFED00D (“cafe dude”) is used by Java as a magic number for their pack200 compression.[15]
0xCEFAEDFE (“face feed”) is used by Mach-O to identify flat (single architecture) object files. In little endian this reads FEEDFACE, “Feed Face”.
0x0D15EA5E (“zero disease”) is a flag that indicates regular boot on the Nintendo GameCube and Wii consoles.[16][17]
0xDABBAD00 (“dabba doo”) is the name of a blog on computer security.[18]
0xDEAD2BAD (“dead too bad”) was used to mark allocated areas of memory that had not yet been initialised on Sequent Dynix/ptx systems.
0xDEADBAAD (“dead bad”) is used by the Android libc abort() function when native heap corruption is detected.
0xDEADBABE (“dead babe”) is used by IBM Jikes RVM as a sanity check of the stack of the primary thread.[19]
0xDEADBEAF (“dead beaf”) is part of the signature code of Jazz Jackrabbit 2 tileset files.[20] Level files have less room for their signatures and use 0xBABE (“babe”) instead.[21] It is also the header of campaign gamesaves used in the Halo game series.
deadbeef-dead-beef-dead-beef00000075 (“dead beef”) is the GUID assigned to hung/dead virtual machines in Citrix XenServer.
0xDEADBEEF (“dead beef”) is frequently used to indicate a software crash or deadlock in embedded systems. 0xDEADBEEF was originally used to mark newly allocated areas of memory that had not yet been initialized—when scanning a memory dump, it is easy to see the 0xDEADBEEF. It is used by IBM RS/6000 systems, Mac OS on 32-bit PowerPC processors, and the Commodore Amiga as a magic debug value. On Sun MicrosystemsSolaris, it marks freed kernel memory. The DEC Alpha SRM console has a background process that traps memory errors, identified by PS as “BeefEater waiting on 0xdeadbeef”.[22]
0xDEADC0DE (“dead code”) is used as a marker in OpenWrt firmware to signify the beginning of the to-be created jffs2 filesystem at the end of the static firmware.
0xDEADDEAD (“dead dead”) is the bug check (STOP) code displayed when invoking a Blue Screen of Death either by telling the kernel via the attached debugger, or by using a special keystroke combination.[23] This is usually seen by driver developers, as it is used to get a memory dump on Windows NT based systems. An alternative to 0xDEADDEAD is the bug check code 0x000000E2,[24] as they are both called MANUALLY_INITIATED_CRASH as seen on the Microsoft Developer Network.
0xDEADD00D (“dead dude”) is used by Android in the Dalvik virtual machine to indicate a VM abort.
0xDEADFA11 (“dead fall” or “dead fail”) is used by Apple in iOS crash reports, when the user force quits an application.[3]
0xDEAD10CC (“dead lock”) is used by Apple in iOS crash reports, when an application holds on to a system resource while running in the background.[3]
0xDEADFEED (“dead feed”) is used by Apple in iOS crash reports, when a timeout occurs spawning a service.
0xDECAFBAD (“decaf bad”) is often found in coding as an easily recognized magic number when hex dumping memory.
0xDEFEC8ED (“defecated”) is the magic number for OpenSolaris core dumps.[25]
0xD0D0CACA (“doo-doo caca”) is the uninitialized value of GPIO values on the Nvidia Tegra X1.[citation needed]
0xE011CFD0 (“docfile0”) is used as a magic number for Microsoft Office files. In little endian this reads D0CF11E0, “docfile0”.[26]
0xF1AC (“FLAC”) is used as the Free Lossless Audio Codec’s audio format tag.[27]
face:b00c (“facebook”) used in the IPv6 addresses of www.facebook.com.[28]
0xFACEFEED (“face feed”) is used by Alpha servers running Windows NT. The Alpha Hardware Abstraction Layer (HAL) generates this error when it encounters a hardware failure.[29]
0xFBADBEEF (“bad beef”) is used in the WebKit and Blink layout engines to indicate a known, unrecoverable error such as out of memory.[30]
0xFEE1DEAD (“feel dead”) is used as a magic number in the Linux reboot system call.[31]
0xFEEDBABE (“feed babe”) is the magic number used to indicate the beginning of an OpenRG flash partition descriptor.[32]
0xFEEDC0DE (“feed code”) is used as filling pattern by the OS-9 operating system when initializing its RAM.[33]
0xFEEDFACECAFEBEEF (“feed face cafe beef”) is the magic number used to send as a password via serial wire to rescue some NXP created controller devices from boot failures.[34][35][36]
0xFFBADD11 (“bad DLL”): Used by Windows internally.[citation needed]
0xF00DBABE (“food babe”): The Ledger Nano hardware cryptocurrency wallet used this magic number in the process of signing that was exploited.[37]

在上面就有我们经常可以看到的0xDEADBEEF的解释了。

扩展

在某些不同的语言中,可能存在扩展的用法;

  • 比如在 C 语言中,我们经常用后缀L来表示一个数是long类型,使用LL来表示long long,这样就可以写出0xDEADCELL(dead cell) 或者0xFEEDBULL(feed bull) 这样的 hexspeak 了;

相关趣闻

hyper-v 是微软研发的一款 hypervisor,在 2009 年的时候,有人发现在 hyper-v 的网络驱动代码中使用了 GPL-licensed 组件,并且是静态编译到闭源的二进制中,因此被要求公开相关代码。Linux 从 kernel2.6.32 开始,都可以包含 hyper-v 半虚拟化支持,用来提高在 windows host 上的 Linux guest 的性能。

当有人查看微软提交到 Linux 内核的 hyper-v 代码时,发现有人使用了0x__B16B00B5__这样的幻数,用 hexspeak 翻译过来就是“BIG BOOBS”。被发现之后微软道歉并修复相关代码。