x86 sbb with same register as first and second operand

Question

I am analyzing a sequence of x86 instructions, and become confused with the following code:

135328495: sbb edx, edx
135328497: neg edx
135328499: test edx, edx
135328503: jz 0x810f31c

I understand that sbb equals to des = des - (src + CF), in other words, the first instruction somehow put -CF into edx. Then it negtive -CF into CF, and test whether CF equals to zero??

But note that jz checks flag ZF, not CF! So basically what is the above code sequence trying to do? This is a legal x86 instruction sequence, produced by g++ version 4.6.3.

Answer 1

The sbb edx, edx statement writes either 0 or -1 to edx, depending only on the value of the carry flag. The following neg edx simply reflects the value of the initial carry flag. Thus the jz in your sequence is nothing else than a jnc statement (jmp on non-carry). However, this sequence might be found with an additional, preceding neg eax. The neg statement clears the carry in the zero case, otherwise sets it. This sequence might be used as a test for true or false, depending whether edx has some arbitrary nonzero value (true) or zero value (false). The sequence with the additional neg would then look like this:

neg edx          ; clears the carry flag in the zero case, otherwise sets it
sbb edx, edx     ; if (cf == 0) then edx == 0, else edx == -1
neg edx          ; remains zero if initially edx has been zero, else 1
test edx, edx    ;
jz toSomewhere   ; jmp on edx having been zero initially

btw, this is one of the questions I am planning for a reversing quiz.

Have fun!