1

The bitmask is used to manipulate the value of the integer variable. From debugging, I guessed that the bitwise operation generates nearest even integer. Here is the assembly:

mov     r8d, 0FFFFFFF8h
jnz     loc_x
mov     eax, [rsp+48]
add     eax, 7
and     eax, r8d
mov     edi, eax
mov     r8d, eax
mov     [rsp+48], rdi
call    operator_new
xor     r8d, r8d
mov     rsi, rax
test    rax, rax
jz      loc_y

The interested pseudo-code is:

a = (b + 7) & 0xFFFFFFF8;
c = a;

So, what does 0xFFFFFFF8 value do? And how can I determine the purpose behind that operation (and possibly any other in future)?

1

No idea what the result is used for, but this is exactly what you'd see if you wanted to "round up" to the nearest 8-byte boundary.

The +7 makes sure to push all the "irrelevant bits" out of the lower 3 bits, while at the same time making sure that we round up (just doing the bitwise & with the integer will not guarantee this outcome). And then the bitwise & with said bitmask makes sure to strip the 3 least significant bits, yielding the result I described above.

Now obviously what exactly this is used for is beyond me, because I lack the context you have by looking at the target binary, but the mechanism should become clear through my answer.

  • b is determined from sizeof and strlen. a and c goes to malloc, HeapAlloc etc. I'll add that in my question. Can you add some ASCII art to metion those bits in a int or long? – Biswapriyo Sep 1 '18 at 20:21
2

Just an addition to 0xC00000022Ls already given explanation. You may find his answer and many other very useful explanations and tricks in the book "Hackers Delight" by Henry S. Warren Jr. :

There in Chapter 3-1. "Rounding Up/Down to a Multiple of a Known Power of 2"

Quote:

... an unsigned integer x can be rounded up to the next greater multiple of 8 with either of

(x+7) & -8 

or

x + (-x+7).

-8 is in 32-bit represented as 0xfffffff8

2

sometimes a python script makes it easier to understand

def bitbut(a,b):
    for i in range(a,b,1):
        b = 0 + i
        c = b + 7
        d = c & 0xfffffff8
        print "%3d" % (d),
    print "\n"
for i in range(0,256,16):
    bitbut(i,i+16)

output

  0   8   8   8   8   8   8   8   8  16  16  16  16  16  16  16 

 16  24  24  24  24  24  24  24  24  32  32  32  32  32  32  32 

 32  40  40  40  40  40  40  40  40  48  48  48  48  48  48  48 

 48  56  56  56  56  56  56  56  56  64  64  64  64  64  64  64 

 64  72  72  72  72  72  72  72  72  80  80  80  80  80  80  80 

 80  88  88  88  88  88  88  88  88  96  96  96  96  96  96  96 

 96 104 104 104 104 104 104 104 104 112 112 112 112 112 112 112 

112 120 120 120 120 120 120 120 120 128 128 128 128 128 128 128 

128 136 136 136 136 136 136 136 136 144 144 144 144 144 144 144 

144 152 152 152 152 152 152 152 152 160 160 160 160 160 160 160 

160 168 168 168 168 168 168 168 168 176 176 176 176 176 176 176 

176 184 184 184 184 184 184 184 184 192 192 192 192 192 192 192 

192 200 200 200 200 200 200 200 200 208 208 208 208 208 208 208 

208 216 216 216 216 216 216 216 216 224 224 224 224 224 224 224 

224 232 232 232 232 232 232 232 232 240 240 240 240 240 240 240 

240 248 248 248 248 248 248 248 248 256 256 256 256 256 256 256 

as can be seen a pattern can be discerned from the output
for any input that is between
0 and 8 both inclusive the output would be 8
9 and 16 both inclusive the output would be 16 and so on
so the assembly snippet rounds up the input to the next boundary
that is a multiple of 8

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.