hi,

I have two questions regarding the following snippet:



* What does SoftIce mean with that ``STATUS_BREAKPOINT'' comment? I searched through the Sice docs, but couldn't find anything about it. It can't be some leftover debug info, as there is none... It doesn't seem too important though, but I'm curious to find out (btw: I am on NTIce now, and didn't see this comment in win98---at least as far as I can remember ;-))

* Regarding the code itself: what could be the meaning of lines 40BFBA..40BFBE? I know they're only executed when the result of the AND sets the sign flag, but what's the use? Note: edx contains the reamainder of an IDIV (in this case always a positive integer, jns is always taken). Obviously, the compiler put these instructions there to deal with negative results of the signed division...but what exactly do they mean ???

Any insight appreciated ;-)

Regards,

m0sk

status breakpoint == 80000003h, its an exception code .. int 3 causes this exception .. dont think it has any meaning with the code u have though . just ignore NTice's auto comments :-)

dec edx / inc edx == decrease edx, increase edx

edx = edx - 1

edx = edx + 1

!

r.e.
Note: edx contains the reamainder of an IDIV (in this case always a positive integer, jns is always taken).

nope, edx contains ecx .. look at the damn code !

:0040BFB0 mov edx, ecx
:0040BFB2 and edx, 80000003h ;STATUS_BREAKPOINT


goodnight

tom,

thanks for your answer on STATUS_BREAKPOINT



lol, hehe, you're right of course (stupid me)

However, my question still remains: why did the compiler put in these extra lines (and what do they do)... ecx is a counter going from 0x0..0x14 --> these instructions will never be executed

???

m0sk

Hi m0sk,

the purpose of the snippet you provided is simply that of remapping a signed integer, stored in EDX (the remainder of an IDIV as you said), into a restricted range of signed values surrounding the zero.

In the case of positive values for EDX the result is rather obvious: it spawns in the range 1 - 4, as we can see from the following table

input -> EDX and 80000003 -> result
-----------------------------------
input 0 -> 00000000 -> 1
input 1 -> 00000001 -> 2
input 2 -> 00000002 -> 3
input 3 -> 00000003 -> 4
input 4 -> 00000000 -> 1
input 5 -> 00000001 -> 2
input 6 -> 00000002 -> 3
input 7 -> 00000003 -> 4
and so on...

In the case of negative values, the code you are asking about simply brings the results near the 0. But there is a further trick to overlap some results to the results obtained from the positive cases (I don't know why, since I don't know the target of this stuff).

I explain myself better with some examples. First comment out the instructions
"0040BFBA dec edx" and "0040BFBE inc edx" before and after the "0040BFBB or edx, 0FFFFFFFCh". In that case the mapping between input and result is linear, without overlappings, as you can see by the following table:

input -> after AND -> after OR -> result
----------------------------------------
input -1 -> 80000003 -> ffffffff -> 0
input -2 -> 80000002 -> fffffffe -> -1
input -3 -> 80000001 -> fffffffd -> -2
input -4 -> 80000000 -> fffffffc -> -3
input -5 -> 80000003 -> ffffffff -> 0
input -6 -> 80000002 -> fffffffe -> -1
input -7 -> 80000001 -> fffffffd -> -2
input -8 -> 80000000 -> fffffffc -> -3
and so on...

But after inserting again the two instructions we commented out, the overlapping is manifest from this new table:

input -> after AND -> after DEC+OR+INC -> result
----------------------------------------
input -1 -> 80000003 -> ffffffff -> 0
input -2 -> 80000002 -> fffffffe -> -1
input -3 -> 80000001 -> fffffffd -> -2
input -4 -> 80000000 -> 00000000 -> 1
input -5 -> 80000003 -> ffffffff -> 0
input -6 -> 80000002 -> fffffffe -> -1
input -7 -> 80000001 -> fffffffd -> -2
input -8 -> 80000000 -> 00000000 -> 1
and so on...

As we can see, the result -3 is no more present, and it is replaced by +1. Why this?
We must look at the overall target of the code to understand this...

Regards.

Thanks a lot DinDon! I've figured it out thanks to your help 8)

The lines do simply the following (both for pos. and neg. values):

edx := (edx MODULO 4) + 1


Simple huh? ;D
Thanks again & happy reversing!

Regards,
m0sk

Good! I missed your last inference!

The beauty of reversing is to find the light from the darkness of chaos!

Bye...