I understand that LOBYTE is an IDA macro for retrieving the lower byte of a variable. My question is what is the difference between the result of x=x-1 and LOBYTE(x)=x-1 when x is smaller than or equal to 0xff? I should add that I'm implicitly assuming that x>0. Thank you!

1 Answer 1

Quote From Link     
#define LOBYTE(x)   (*((_BYTE*)&(x))) 

is that a hypothetical query x is treated as address
so x-1 will be a 32 bit type on a x86 machine so theoretically
you cannot assign a 32 bit type to an 8 bit type
LOBYTE(x) will be a byte and not an address so again theoretically you cannot assign a byte to a byte

LOBYTE(x) is an AND operation that extracts the unsigned byte from a specific address

x as address    contents         LOBYTE(x)     (byte *)&x = LOBYTE(x)-1
0x00400000      0xffffffff       0x000000ff    byte[0x004000000] = 0x000000ff -1 =0x000000fe

so if you look as a DWORD 0x400000 will now contain 0xfffffffe

demo using a python script

:\>cat LOBYTE.py
import ctypes

def LOBYTE(arg):
    return arg.value & 0x000000ff

x = ctypes.c_ulong(0xffffffff)
print( "x as address" , ctypes.byref(x))
print( "x holds"  , hex(x.value))
print("result of LOBYTE(x)", LOBYTE(x))
x.value = ( (x.value & 0xffffff00 ) | LOBYTE(x)- 1 )
print( "x holds"  , hex(x.value))

:\>python LOBYTE.py
x as address <cparam 'P' (017CA098)>
x holds 0xffffffff
result of LOBYTE(x) 255
x holds 0xfffffffe

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.