1

I'm pretty sure that original code was much simpler:

(((x + 16) >> 31) ^ abs(x + 16) & 3) + 4 * ((y + 16) % 4) - ((x + 16) >> 31)

Looks like division with remainder... Any ideas what this could be?

The code was compiled with Visual Studio 6.0.

1
  • I don't think the high order code could be simpler, it's isolating the highest bit in a 32 bit value. I can't think of any standard mathematical reason to xor the highest bit with the lowest 2 bits after adding 16. Commented Jan 10, 2023 at 9:46

1 Answer 1

0

I should have attached disassembler listing:

.text:004486EA 02C                 mov     eax, [ebp+arg_4]
.text:004486ED 02C                 add     eax, 10h
.text:004486F0 02C                 cdq
.text:004486F1 02C                 xor     eax, edx
.text:004486F3 02C                 sub     eax, edx
.text:004486F5 02C                 and     eax, 3
.text:004486F8 02C                 xor     eax, edx
.text:004486FA 02C                 sub     eax, edx
.text:004486FC 02C                 lea     ecx, ds:0[eax*4]
.text:00448703 02C                 mov     eax, [ebp+arg_0]
.text:00448706 02C                 add     eax, 10h
.text:00448709 02C                 cdq
.text:0044870A 02C                 xor     eax, edx
.text:0044870C 02C                 sub     eax, edx
.text:0044870E 02C                 and     eax, 3
.text:00448711 02C                 xor     eax, edx
.text:00448713 02C                 sub     ecx, edx
.text:00448715 02C                 add     ecx, eax
.text:00448717 02C                 mov     dword_524CEC, ecx

The right answer is:

(x + 16) % 4 + 4 * ((y + 16) % 4)

It gets obvious if you assume positive x and y.

Usually IDA Pro detects such cases, but I think last two instructions were confusing for the analyzer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.