Mastering Reverse Engineering

Addition and subtraction

In addition (ADD) and subtraction (SUB), the OF, SF, and CF flags are affected. Let's see some examples of usage as instruction.

add eax, ecx adds whatever value is in the ecx register to the value in eax. The results of adding eax and ecx goes into eax.

Let's take the following example to see how it sets the OF, SF and CF flags:

mov ecx, 0x0fffffffmov ebx, 0x0fffffffadd ecx, ebx

The registers are DWORDs. The ecx and ebx registers were set with 0x0fffffff (‭268,435,455‬), adding these results to 0x1ffffffe (‭536,870,910‬). SF was not set, since the result did not touch the most significant bit (MSB). CF was not set because the result is still within the capacity of a DWORD. Assuming that both were signed numbers, ...