2

I have found the following lines in a sample which I try to analyze. Here, are the lines:

   ....
   push  afg.00401189       "ntdll.dll" 
   call  GetmoduleHandleW
   neg   eax
   sbb   eax, eax
   neg   eax
   RETN

So, I do not understand the lines after the call instruction. We have sbb instruction between two neg-operations, but what can be the purpose of that. Can somebody explain that ?

PS: Intuitively, I would say that at the end I have the handle to ntdll.dll in EAX...but the operations between the call and retn are very strange. I am confused.

2

The neg / sbb / neg code in your question is the equivalent of the following C code:

eax = (eax != 0)

In other words, the function returns GetModuleHandleW("ntdll.dll") != NULL.

The neg / sbb / neg construct is explained in detail here:

Reversing: Secrets of Reverse Engineering, section A.2.8.1. Pure Arithmetic Implementations

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.