3

IDA generates the following disassembly from a software :

.text:004D594E add     eax, ebx
.text:004D5950 mov     [esi], eax
.text:004D5952 cmp     ebx, eax
.text:004D5954 jbe     short loc_

So we add ebx to eax, then we check if ebx is lower or equal to eax.

This is either a check to see if ebx is negative or to see if the addition resulted in a value higher than 0xFFFFFFFF.

Any hint on how I should interpret this?

2

we check if eax is lower or equal to ebx.

No, cmp ebx, eax; jbe ... checks to see if ebx <= eax, not the other way around.

|improve this answer|||||
  • ugg, edited the question – Eric Dec 13 '14 at 4:50
  • The question here is really how can adding ebx to eax make eax lower than ebx – Eric Dec 13 '14 at 4:50
  • 1
    So this is an overflow check, is there any other way to interpret those operations? – Eric Dec 13 '14 at 5:09
  • The question here is really how can adding ebx to eax make eax lower than ebx only when eax wraps around and becomes zero that is when eax = 0xffffffff and ebx = 1 adding ebx t o eax turns eax to 0 which is then below ebx assemble this inplace and execute and you can observe esi = 0xffffffff when ebfe is reached MOV EAX, 0 MOV EBX, 1MOV ESI, EAX ADD EAX, EBX CMP EBX, EAX JBE SHORT 063FB2 JMP SHORT 1063FB0 JMP SHORT 01063FA8 – blabb Dec 13 '14 at 7:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.