I'm pretty sure that original code was much simpler:
(((x + 16) >> 31) ^ abs(x + 16) & 3) + 4 * ((y + 16) % 4) - ((x + 16) >> 31)
Looks like division with remainder... Any ideas what this could be?
The code was compiled with Visual Studio 6.0.
-
I don't think the high order code could be simpler, it's isolating the highest bit in a 32 bit value. I can't think of any standard mathematical reason to xor the highest bit with the lowest 2 bits after adding 16.– Mega TonnageJan 10 at 9:46
Add a comment
|
1 Answer
I should have attached disassembler listing:
.text:004486EA 02C mov eax, [ebp+arg_4]
.text:004486ED 02C add eax, 10h
.text:004486F0 02C cdq
.text:004486F1 02C xor eax, edx
.text:004486F3 02C sub eax, edx
.text:004486F5 02C and eax, 3
.text:004486F8 02C xor eax, edx
.text:004486FA 02C sub eax, edx
.text:004486FC 02C lea ecx, ds:0[eax*4]
.text:00448703 02C mov eax, [ebp+arg_0]
.text:00448706 02C add eax, 10h
.text:00448709 02C cdq
.text:0044870A 02C xor eax, edx
.text:0044870C 02C sub eax, edx
.text:0044870E 02C and eax, 3
.text:00448711 02C xor eax, edx
.text:00448713 02C sub ecx, edx
.text:00448715 02C add ecx, eax
.text:00448717 02C mov dword_524CEC, ecx
The right answer is:
(x + 16) % 4 + 4 * ((y + 16) % 4)
It gets obvious if you assume positive x and y.
Usually IDA Pro detects such cases, but I think last two instructions were confusing for the analyzer.