Hot answers tagged

2

It's not add -183. 0xFFFFFE7d is equal to -387. The original conditions is this 387 <= x <= 390 if we add -387 to all the sides we get 0 <= x + (-387) <= 3 and this is exactly what's checked in the code. As why the code is unstable? Well it would require a bit more detailed analysis (debugging?) but what I can see is this. Just after the code ...


1

In a nutshell, stripping a binary means removing sections containing symbol and debug information from the file. These sections lie at the end of the binary, separate from the code. Removing this information has no bearing on the code itself, so the locations of functions in the file (their file offsets) will be the same after stripping the binary. Function ...


1

To add to Paweł Łukasik's answer, the issue with ECX surrounds what is known as a 'calling convention'. Calling conventions set out the obligations on both the caller of a function and on the called function itself. Microsoft's 32-bit calling convention is described here. It says that an obligation on the called function is - The compiler generates prolog ...


Only top voted, non community-wiki answers of a minimum length are eligible