Is this equivalent to overflow check

Question

IDA generates the following disassembly from a software :

.text:004D594E add     eax, ebx
.text:004D5950 mov     [esi], eax
.text:004D5952 cmp     ebx, eax
.text:004D5954 jbe     short loc_

So we add ebx to eax, then we check if ebx is lower or equal to eax.

This is either a check to see if ebx is negative or to see if the addition resulted in a value higher than 0xFFFFFFFF.

Any hint on how I should interpret this?

Jason Geffner · Accepted Answer · 2014-12-13 04:49:22Z

2

we check if eax is lower or equal to ebx.

No, cmp ebx, eax; jbe ... checks to see if ebx <= eax, not the other way around.

answered Dec 13 '14 at 4:49

Jason Geffner

20.2k1 gold badge30 silver badges69 bronze badges

ugg, edited the question – Eric Dec 13 '14 at 4:50
The question here is really how can adding ebx to eax make eax lower than ebx – Eric Dec 13 '14 at 4:50
en.wikipedia.org/wiki/Integer_overflow – Jason Geffner Dec 13 '14 at 5:06
1

So this is an overflow check, is there any other way to interpret those operations? – Eric Dec 13 '14 at 5:09
The question here is really how can adding ebx to eax make eax lower than ebx only when eax wraps around and becomes zero that is when eax = 0xffffffff and ebx = 1 adding ebx t o eax turns eax to 0 which is then below ebx assemble this inplace and execute and you can observe esi = 0xffffffff when ebfe is reached MOV EAX, 0 MOV EBX, 1MOV ESI, EAX ADD EAX, EBX CMP EBX, EAX JBE SHORT 063FB2 JMP SHORT 1063FB0 JMP SHORT 01063FA8 – blabb Dec 13 '14 at 7:17

Add a comment |

1 Answer 1