Learning Malware Analysis

5. Bitwise Operations

In this section, you will learn the assembly instructions that operate on the bits. The bits are numbered starting from the far right; the rightmost bit (least significant bit) has a bit position of 0, and the bit position increases toward the left. The left-most bit is called the most significant bit. The following is an example showing the bits and the bit positions for a byte, 5D (0101 1101). The same logic applies to a word, dword, and qword:

One of the bitwise instructions is the not instruction; it takes only one operand (which serves as both the source and destination) and inverts all of the bits. If eax contained ...