unsigned __int8 v2; // cf@1
v2 = __CFSHL__(v3, 28);

What does the CFSHL function mean? I can't seem to find any documentation on it.

1 Answer 1


This function usually generate a 'Carry Flag for SHift Left' operators (CFSHL).

__CFSHL__(x, y) // Generate a carry flag for (x<<y)

In fact, when decompiling we, sometimes, loose the origin of the very-low level operations such as manipulation of carry flags. Originally, this operation must have been linked to some arithmetic operation which might have been missed by the decompiler (or optimized out). But, the manipulation of the carry bit on the eflags is still here, so to keep the semantic equivalence of the decompiled program, Hexrays' decompiler is sometimes forced to use such tricks (which appears to come from outer space even if they probably have a perfectly natural cause).

  • Thanks for the answer. Im a bit new to reverse engineering, and ida. So what does the operation actually do to the variables, x and y? Commented Sep 25, 2017 at 17:23
  • In fact, it does not touch x and y. It simply computes if the carry bit of the %eflags must be touched if an operation x << y would have been performed (but without performing it). Sorry, I should have been clearer... I wrote my answer a bit too quickly. Shame on me. :-/
    – perror
    Commented Sep 25, 2017 at 17:25
  • @user1698144: You still didn't get it, right ? If so, it really means that you lack a lot of background in assembly. You should learn a bit more about it.
    – perror
    Commented Sep 26, 2017 at 7:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.