Reverse Engineering for Beginners

(avery) #1

CHAPTER 30. SIGNED NUMBER REPRESENTATIONS CHAPTER 30. SIGNED NUMBER REPRESENTATIONS


Chapter 30


Signed number representations


There are several methods for representing signed numbers^1 , but “two’s complement” is the most popular one in computers.


Here is a table for some byte values:


binary hexadecimal unsigned signed (2’s complement)
01111111 0x7f 127 127
01111110 0x7e 126 126
...
00000110 0x6 6 6
00000101 0x5 5 5
00000100 0x4 4 4
00000011 0x3 3 3
00000010 0x2 2 2
00000001 0x1 1 1
00000000 0x0 0 0
11111111 0xff 255 -1
11111110 0xfe 254 -2
11111101 0xfd 253 -3
11111100 0xfc 252 -4
11111011 0xfb 251 -5
11111010 0xfa 250 -6
...
10000010 0x82 130 -126
10000001 0x81 129 -127
10000000 0x80 128 -128

The difference between signed and unsigned numbers is that if we represent0xFFFFFFFEand0x00000002as unsigned,
then the first number (4294967294) is bigger than the second one (2). If we represent them both as signed, the first one
becomes− 2 , and it is smaller than the second (2). That is the reason why conditional jumps (12 on page 114) are present
both for signed (e.g.JG,JL) and unsigned (JA,JB) operations.


For the sake of simplicity, this is what one needs to know:



  • Numbers can be signed or unsigned.

  • C/C++ signed types:

    • int64_t(-9,223,372,036,854,775,808..9,223,372,036,854,775,807) (- 9.2.. 9.2 quintillions) or
      0x8000000000000000..0x7FFFFFFFFFFFFFFF),

    • int(-2,147,483,648..2,147,483,647 (- 2.15.. 2.15Gb) or0x80000000..0x7FFFFFFF),

    • char(-128..127 or0x80..0x7F),

    • ssize_t.




Unsigned:


  • uint64_t(0..18,446,744,073,709,551,615 ( 18 quintillions) or0..0xFFFFFFFFFFFFFFFF),

  • unsigned int(0..4,294,967,295 ( 4.3Gb) or0..0xFFFFFFFF),

  • unsigned char(0..255 or0..0xFF),


(^1) wikipedia

Free download pdf