Reversing : The Hacker's Guide to Reverse Engineering

Table A.3 (continued)

SATISFIED

MNEMONICS FLAGS WHEN COMMENTS

If Less or ZF = 1 OR X<= Y This code is the same

Equal (LE) ((OF = 1 AND SF = 0) OR as the preceding code

If Not (OF = 0 AND SF = 1)) with the exception

Greater (NG) that it also checks ZF

and so would also be

satisfied if the

operands are equal.

Unsigned Conditional Codes

Table A.4 presents the IA-32 conditional codes defined for unsigned operands.

Note that in all unsigned conditional codes, overflows are detected using the

carry flag (CF). This is because the arithmetic instructions use CF for indicat-

ing unsigned overflows.

Table A.4 Unsigned Conditional Codes

SATISFIED

MNEMONICS FLAGS WHEN COMMENTS

If Above (A) CF = 0 AND ZF = 0 X> Y Use CF to confirm that

If Not Below or the second operand is

Equal (NBE) not larger than the

first (because then CF

would be set), and ZF

to confirm that the

operands are unequal.

If Above or CF = 0 X>= Y This code is similar to

Equal (AE) the above with the

If Not exception that it only

Below (NB) checks CF, so it would

If Not Carry (NC) also be satisfied by

equal operands.

If Below (B) CF = 1 X< Y When CF is set we

If Not Above or know that the second

Equal (NAE) operand is greater

If Carry (C) than the first because

an overflow could only

mean that the result

was negative.

(continued)

Deciphering Code Structures 485

21_574817 appa.qxd 3/16/05 8:52 PM Page 485