I understand that LOBYTE is an IDA macro for retrieving the lower byte of a variable. My question is what is the difference between the result of x=x-1
and LOBYTE(x)=x-1
when x
is smaller than or equal to 0xff
? I should add that I'm implicitly assuming that x>0
. Thank you!
Quote From Link
#define LOBYTE(x) (*((_BYTE*)&(x)))
is that a hypothetical query x is treated as address
so x-1 will be a 32 bit type on a x86 machine so theoretically
you cannot assign a 32 bit type to an 8 bit type
LOBYTE(x) will be a byte and not an address so again
theoretically you cannot assign a byte to a byte
LOBYTE(x) is an AND operation that extracts the unsigned byte from a specific address
x as address contents LOBYTE(x) (byte *)&x = LOBYTE(x)-1
0x00400000 0xffffffff 0x000000ff byte[0x004000000] = 0x000000ff -1 =0x000000fe
so if you look as a DWORD 0x400000 will now contain 0xfffffffe
demo using a python script
:\>cat LOBYTE.py
import ctypes
def LOBYTE(arg):
return arg.value & 0x000000ff
x = ctypes.c_ulong(0xffffffff)
print( "x as address" , ctypes.byref(x))
print( "x holds" , hex(x.value))
print("result of LOBYTE(x)", LOBYTE(x))
x.value = ( (x.value & 0xffffff00 ) | LOBYTE(x)- 1 )
print( "x holds" , hex(x.value))
:\>python LOBYTE.py
x as address <cparam 'P' (017CA098)>
x holds 0xffffffff
result of LOBYTE(x) 255
x holds 0xfffffffe