banner
lca

lca

真正的不自由,是在自己的心中设下牢笼。

"Learning Notes on IDA Reverse Engineering from Scratch - 11 (Flag Registers)"

Carry Flag: The Carry Flag (CF register) is triggered when the result of an operation is negative or exceeds the numerical limit. It means that if the calculation result exceeds the range, the CF flag will be triggered. Similarly, if the result of subtracting two unsigned numbers is negative, the CF flag will also be triggered.

Overflow Flag: The OF flag is similar to the CF flag, but it applies to signed numbers. It is triggered when there is an error in the calculation of signed numbers.

Signed Flag: The SF flag is triggered if the result of any operation is a negative number. SF only indicates the sign of the result, not whether the result is correct or not.

Zero Flag: The ZF flag is triggered under the following conditions: in internal comparison instructions that actually perform subtraction, when both operands are the same; when an increment or decrement operation results in zero; when the result of subtraction is zero.

Conditional Jump and Flags: When two operands are the same, the JZ instruction will perform a jump. If the first unsigned operand is smaller than the second, the JB instruction will perform a jump. If the first signed operand is smaller than the second, the JL instruction will perform a jump. Generally, it is only necessary to look at the third column of the unsigned conditional jump and signed conditional jump tables.

asmconditionoperation
JAz=0 and c=0jump if above
JAEc=0jump if above or equal
JBc=1jump if below
JBEz=1 or c=1jump if below or equal
JCc=1jump if carry
JECXZecx=0jump if ecx is 0
JEz=1jump if equal
JZz=1jump if zero
JNEz=0jump if not equal
JNZz=0jump if not zero
JOoverflowjump if overflow
JPeven parityjump if parity
JPEeven parityjump if parity even
JNPnot even parityjump if not parity
JPOodd parityjump if parity odd
JSsign=1jump if sign
JNSsign=0jump if not sign
JL/JNGEsign=overflowjump if less or not greater/equal
JLE/JNGz=1 or sign=overflowjump if less or equal/not greater
JG/JNLEz=0 and sign=overflowjump is greater/not less or equal
Loading...
Ownership of this post data is guaranteed by blockchain and smart contracts to the creator alone.