How to identify the purpose behind a bitmask?

The bitmask is used to manipulate the value of the integer variable. From debugging, I guessed that the bitwise operation generates nearest even integer. Here is the assembly:

``````mov     r8d, 0FFFFFFF8h
jnz     loc_x
mov     eax, [rsp+48]
and     eax, r8d
mov     edi, eax
mov     r8d, eax
mov     [rsp+48], rdi
call    operator_new
xor     r8d, r8d
mov     rsi, rax
test    rax, rax
jz      loc_y
``````

The interested pseudo-code is:

``````a = (b + 7) & 0xFFFFFFF8;
c = a;
``````

So, what does `0xFFFFFFF8` value do? And how can I determine the purpose behind that operation (and possibly any other in future)?

No idea what the result is used for, but this is exactly what you'd see if you wanted to "round up" to the nearest 8-byte boundary.

The +7 makes sure to push all the "irrelevant bits" out of the lower 3 bits, while at the same time making sure that we round up (just doing the bitwise `&` with the integer will not guarantee this outcome). And then the bitwise `&` with said bitmask makes sure to strip the 3 least significant bits, yielding the result I described above.

Now obviously what exactly this is used for is beyond me, because I lack the context you have by looking at the target binary, but the mechanism should become clear through my answer.

• `b` is determined from sizeof and strlen. `a` and `c` goes to malloc, HeapAlloc etc. I'll add that in my question. Can you add some ASCII art to metion those bits in a int or long? – Biswapriyo Sep 1 '18 at 20:21

Just an addition to 0xC00000022Ls already given explanation. You may find his answer and many other very useful explanations and tricks in the book "Hackers Delight" by Henry S. Warren Jr. :

There in Chapter 3-1. "Rounding Up/Down to a Multiple of a Known Power of 2"

Quote:

... an unsigned integer x can be rounded up to the next greater multiple of 8 with either of

``````(x+7) & -8
``````

or

``````x + (-x+7).
``````

-8 is in 32-bit represented as `0xfffffff8`

sometimes a python script makes it easier to understand

``````def bitbut(a,b):
for i in range(a,b,1):
b = 0 + i
c = b + 7
d = c & 0xfffffff8
print "%3d" % (d),
print "\n"
for i in range(0,256,16):
bitbut(i,i+16)
``````

output

``````  0   8   8   8   8   8   8   8   8  16  16  16  16  16  16  16

16  24  24  24  24  24  24  24  24  32  32  32  32  32  32  32

32  40  40  40  40  40  40  40  40  48  48  48  48  48  48  48

48  56  56  56  56  56  56  56  56  64  64  64  64  64  64  64

64  72  72  72  72  72  72  72  72  80  80  80  80  80  80  80

80  88  88  88  88  88  88  88  88  96  96  96  96  96  96  96

96 104 104 104 104 104 104 104 104 112 112 112 112 112 112 112

112 120 120 120 120 120 120 120 120 128 128 128 128 128 128 128

128 136 136 136 136 136 136 136 136 144 144 144 144 144 144 144

144 152 152 152 152 152 152 152 152 160 160 160 160 160 160 160

160 168 168 168 168 168 168 168 168 176 176 176 176 176 176 176

176 184 184 184 184 184 184 184 184 192 192 192 192 192 192 192

192 200 200 200 200 200 200 200 200 208 208 208 208 208 208 208

208 216 216 216 216 216 216 216 216 224 224 224 224 224 224 224

224 232 232 232 232 232 232 232 232 240 240 240 240 240 240 240

240 248 248 248 248 248 248 248 248 256 256 256 256 256 256 256
``````

as can be seen a pattern can be discerned from the output
for any input that is between
0 and 8 both inclusive the output would be 8
9 and 16 both inclusive the output would be 16 and so on
so the assembly snippet rounds up the input to the next boundary
that is a multiple of 8