unsigned __int8 v2; // cf@1
v2 = __CFSHL__(v3, 28);
What does the CFSHL function mean? I can't seem to find any documentation on it.
Add a comment
|
1 Answer
This function usually generate a 'Carry Flag for SHift Left' operators (CFSHL).
__CFSHL__(x, y) // Generate a carry flag for (x<<y)
In fact, when decompiling we, sometimes, loose the origin of the very-low level operations such as manipulation of carry flags. Originally, this operation must have been linked to some arithmetic operation which might have been missed by the decompiler (or optimized out). But, the manipulation of the carry bit on the eflags is still here, so to keep the semantic equivalence of the decompiled program, Hexrays' decompiler is sometimes forced to use such tricks (which appears to come from outer space even if they probably have a perfectly natural cause).
-
Thanks for the answer. Im a bit new to reverse engineering, and ida. So what does the operation actually do to the variables, x and y? Sep 25, 2017 at 17:23
-
In fact, it does not touch
xandy. It simply computes if the carry bit of the%eflagsmust be touched if an operationx << ywould have been performed (but without performing it). Sorry, I should have been clearer... I wrote my answer a bit too quickly. Shame on me. :-/– perrorSep 25, 2017 at 17:25 -
@user1698144: You still didn't get it, right ? If so, it really means that you lack a lot of background in assembly. You should learn a bit more about it.– perrorSep 26, 2017 at 7:09