# Is this equivalent to overflow check

IDA generates the following disassembly from a software :

``````.text:004D594E add     eax, ebx
.text:004D5950 mov     [esi], eax
.text:004D5952 cmp     ebx, eax
.text:004D5954 jbe     short loc_
``````

So we add `ebx` to `eax`, then we check if `ebx` is lower or equal to `eax`.

This is either a check to see if ebx is negative or to see if the addition resulted in a value higher than `0xFFFFFFFF`.

Any hint on how I should interpret this?

we check if `eax` is lower or equal to `ebx`.

No, `cmp ebx, eax; jbe ...` checks to see if `ebx` `<=` `eax`, not the other way around.

• ugg, edited the question
– Eric
Dec 13, 2014 at 4:50
• The question here is really how can adding ebx to eax make eax lower than ebx
– Eric
Dec 13, 2014 at 4:50
• So this is an overflow check, is there any other way to interpret those operations?
– Eric
Dec 13, 2014 at 5:09
• The question here is really how can adding ebx to eax make eax lower than ebx only when eax wraps around and becomes zero that is when eax = 0xffffffff and ebx = 1 adding ebx t o eax turns eax to 0 which is then below ebx assemble this inplace and execute and you can observe esi = 0xffffffff when ebfe is reached MOV EAX, 0 MOV EBX, 1MOV ESI, EAX ADD EAX, EBX CMP EBX, EAX JBE SHORT 063FB2 JMP SHORT 1063FB0 JMP SHORT 01063FA8 Dec 13, 2014 at 7:17