3

I'm trying to figure out what does this piece of code exactly:

  LODWORD(fMax) = *(_DWORD *)v12;
  HIDWORD(fMax) = v13;

I was reading on IDA\Plugins\defs.h the definition, but I don't understand what does exactly to redo the same thing on Java.

I'll be really really glad if someone of you can help me.

  • LODWORD() takes the low DWORD from fMax, and HIDWORD() the high DWORD. Basically, if you got an __int64 like this: x = 0xFFFFFFFFAAAAAAAA, LODWORD(x) is 0xAAAAAAAA and HIDWORD(x) is 0xFFFFFFFF – rev Feb 20 '15 at 1:27
  • So this two variables are basically changin the value of fMax. for example as you said, if i had fMax = 0xFFFFFFFFAAAAAAAA and v12 = 0xFFCD0000... the final value of LODWORD(fMax) would be 0xFFFFFFFFFFCD0000. i'm right? – Criss Moreyra Feb 20 '15 at 2:24
  • Yes, you're right. However, i assume you omitted a &, and the first expression should read ...*(_DWORD *) &v12, as you want to select the low 32 bits from v12, instead of treating v12 as a pointer. – Guntram Blohm Feb 20 '15 at 6:49
5

This pattern is typical for assigning a 64-bit value to a variable on a 32 bit system - you calculate each 32-bit value separately, then push them into the high and low 32 bits of the 64 bit value.

In Java, your first assignment would be

fMax=(fMax & 0xFFFFFFFF00000000) | (v12 & 0x00000000FFFFFFFF)

and the second would be

fMax=(fMax & 0x00000000FFFFFFFF) | (((long)v13<<32) & 0xFFFFFFFF00000000)

Of course, fMax is a 64 bit long here.

You can omit the & 0xFFFFFFFF00000000 from the second expression, as you know those bits will be zero after the left shift. And you can omit the & 0x00000000FFFFFFFF from the first expression if v12 is an int, since the high bits will be zero anyway in a 32 bit integer. But the java compiler will probably optimize these away anyway, and i wanted to write the statements in a way that makes clear which bits are taken from fMax, and which from v12 and v13.

  • Thank you, i've understood but now i found this SHIDWORD(v10) i assume this is something like do fMax = (fMax & 0xFFFFFFFF00000000) | (v10 + 1) i'm right? – Criss Moreyra Feb 22 '15 at 2:29
  • SHIDWORD is the sign extended HIDWORD. The SHIDWORD of a negative 32-bit value is FFFFFFFF, and the SHIDWORD of a positive 32-bit value is 0. The +1 does not apply to the value, as in your v10 + 1, it applies to the pointer - one DWORD after the one at the address of v10. – Guntram Blohm Feb 22 '15 at 6:40
  • 1
    How can I convert that in simple C code? IDA interpreted this mov [rsp+56], eax to this LODWORD(v1) = v2;, v1 goes to a unknown/undocumented function. – Biswapriyo Aug 4 '18 at 20:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.