2

Here is an example of the bt instruction in a X64 Windows binary:

bt      eax, 18h
jnb     short loc_a
lea     rcx, String
call    cs:__imp_wprintf
mov     eax, [rbx+40h]

In pseudocode:

if ( _bittest(&Mode, 0x18u) )
{
  wprintf(L"String");
  Mode = Properties->Mode;
}

What is the _bittest macro used in a IF statement? Is it similar with if(a & b == b) or something? The code if(a & b == b) is used for checking if a flag is present in an OR-ed flag. And from debugging, I found the above assembly code is doing something like that.

3

It tests if the nth bit is set, returns true if set, false if not set.

It's basically the same as if(a & (1 << num_bit)) as the argument is the number of the bit to test rather than the bit (or flag if you will) itself.

2

_bittest is a compiler intrinsic which maps to the bt instruction:

Generates the bt instruction, which examines the bit in position b of address a, and returns the value of that bit.

unsigned char _bittest(  
   long const *a,  
   long b  
);
1

bt is an x86 instruction to check if a bit is set in a number/value. It sets CF flag as the value of that bit and you can use jb/jnb/jc/jnc to check if its 1/0.

bt      eax, 18h

As already mentioned in @Johann's answer, its equivalent to python

CF = (eax & (1 << 0x18)) >> 0x18

I have added some code for you to play with it here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.