Reversing : The Hacker's Guide to Reverse Engineering

The above addition will produce different results, depending on whether

the destination operand is treated as signed or unsigned. When presented in

hexadecimal form, the result is 0x8326, which is equivalent to 33574—assum-

ing that AXis considered to be an unsigned operand. If you’re treating AXas a

signed operand, you will see that an overflow has occurred. Because any

signed number that has the most significant bit set is considered negative,

0x8326becomes –31962. It is obvious that because a signed 16-bit operand

can only represent values up to 32767, adding 4390 and 29184 would produce

an overflow, and AXwould wraparound to a negative number. Therefore, from

an unsigned perspective no overflow has occurred, but if you consider the des-

tination operand to be signed, an overflow has occurred. Because of this, the

preceding code would result in OF (representing overflows in signed

operands) being set and in CF (representing overflows in unsigned operands)

being cleared.

The Zero Flag (ZF)

The zero flag is set when the result of an arithmetic operation is zero, and it is

cleared if the result is nonzero. ZF is used in quite a few different situations in

IA-32 code, but probably one of the most common uses it has is for comparing

two operands and testing whether they are equal. The CMPinstruction sub-

tracts one operand from the other and sets ZF if the pseudoresult of the sub-

traction operation is zero, which indicates that the operands are equal. If the

operands are unequal, ZF is set to zero.

The Sign Flag (SF)

The sign flag receives the value of the most significant bit of the result (regard-

less of whether the result is signed or unsigned). In signed integers this is

equivalent to the integer’s sign. A value of 1 denotes a negative number in the

result, while a value of 0 denotes a positive number (or zero) in the result.

The Parity Flag (PF)

The parity flag is a (rarely used) flag that reports the binary parity of the lower

8 bits of certain arithmetic results. Binary parity means that the flag reports the

parity of the number of bits set, as opposed to the actual numeric parity of the

result. A value of 1 denotes an even number of set bits in the lower 8 bits of the

result, while a value of 0 denotes an odd number of set bits.

Understanding Compiled Arithmetic 521

22_574817 appb.qxd 3/16/05 8:45 PM Page 521