1
  unsigned __int8 v2; // cf@1
v2 = __CFSHL__(v3, 28);

What does the CFSHL function mean? I can't seem to find any documentation on it.

1

This function usually generate a 'Carry Flag for SHift Left' operators (CFSHL).

__CFSHL__(x, y) // Generate a carry flag for (x<<y)

In fact, when decompiling we, sometimes, loose the origin of the very-low level operations such as manipulation of carry flags. Originally, this operation must have been linked to some arithmetic operation which might have been missed by the decompiler (or optimized out). But, the manipulation of the carry bit on the eflags is still here, so to keep the semantic equivalence of the decompiled program, Hexrays' decompiler is sometimes forced to use such tricks (which appears to come from outer space even if they probably have a perfectly natural cause).

3
  • Thanks for the answer. Im a bit new to reverse engineering, and ida. So what does the operation actually do to the variables, x and y? – user1698144 Sep 25 '17 at 17:23
  • In fact, it does not touch x and y. It simply computes if the carry bit of the %eflags must be touched if an operation x << y would have been performed (but without performing it). Sorry, I should have been clearer... I wrote my answer a bit too quickly. Shame on me. :-/ – perror Sep 25 '17 at 17:25
  • @user1698144: You still didn't get it, right ? If so, it really means that you lack a lot of background in assembly. You should learn a bit more about it. – perror Sep 26 '17 at 7:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.