Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
sar eax, 6
...
sar eax, 0x1f
This arithmetic shift operation confuses me. Understand that it's taking the value of eax in hex then shifting it to the right by 6 and the same for the next operation by 0x1f. See what the end result is, but still looking to better understand what's happening with these Shift Operations.
Say eax was 0x3338e3e0, how exactly does it get to 0x00cce38f step by step?
It's easier to see what's going on if you work in binary.
0x3338e3e0 is 0b00110011001110001110001111100000
Shifting this right by 6 bits (i.e. removing the last 6 bits and adding 6 zeros at the start) gives -
0b00000000110011001110001110001111
Finally, turning this back into hex gives the value in your question.
0b 0000 0000 1100 1100 1110 0011 1000 1111 = 0x00CCE38F
C:\>python -c "print \"{0:8X}={0:b}\n{1:8X}={1:b}\".format(0x3338e3e0,0x3338e3e0>>6)"
3338E3E0=110011001110001110001111100000
CCE38F=110011001110001110001111
