CODEWITHSUNDEEP
debuggingreverseollydbg
user3127031
user3127031

Reputation: 23

Reverse Engineering - AND 0FF

I do some reverse engineering stuff with simple crackme app and I'am debugging it with OllyDbg.

I'm stuck at the behavior of instruction AND with operand 0x0FF. I mean It's equivalent in C++ to if(... = true).

So what's confusing is that:


    ECX = CCCCCC01
    ZF = 1
    AND ECX, 0FF
    ### After instruction
    ECX  = 00000001
    ZF = 0
    ZF - Should be active

I don't know why is result of ECX register 1 and ZF isn't active.

AND => 1 , 1 = 1 (Same operands) Otherwise = 0

Can someone explain me that?

thankx for help

Upvotes: 1

Views: 336

Answers (1)

Theodore Norvell
Theodore Norvell

Reputation: 16221

It's a bit-wise AND, so in binary you have

    1100 1100 1100 1100 1100 1100 0000 0001
AND 0000 0000 0000 0000 0000 0000 1111 1111
    ----------------------------------------
    0000 0000 0000 0000 0000 0000 0000 0001

Upvotes: 1

Related Questions