Hello and welcome back.
In this lesson, we will take a look at how the - register
works.
The - register works with the signed operations.
That means it can be positive or negative numbers.
So if the target -, the target register is too small,
for example, if you are using - or - or -, is only one byte, the range of it is -128 to positive
127.
If we perform arithmetic operations which exceed this range, go beyond this range,
either is too big, bigger than 127, or less than -128,
then the flag will be set.
So let's try to do this now and see how it works in
x64dbg.
So we put a breakpoint here, we run to it, and we step to this new line here.
Now we put something in the - register.
Let's say we put, right-click, modify, for signed,
we put positive 127.
Let's say positive 127.
So positive 127 is 7F in hex.
So now we try to add ten to it to make it overflow.
So let's see what happens.
We add to -, ten, and then click okay.
Now we step over this and watch your overflow flag. Step over, and you see the overflow flag is set,
meaning that an overflow has occurred.
Adding ten to 127
is bigger than the one byte.
So therefore, it overflows and overflow is set.
So the same thing happens to negative if we minus something from this number and it
overflows.
Then the overflow will also be set.
So let's try that now.
Now we will experiment with - register instead.
So we now try the - register.
We put a negative value, -128, negative 128,
let's say.
So negative 128 is 80 in hex.
So -128.
So now we try to minus ten from this -.
Sub -, ten.
Here we step over, and you see the - flag is still maintained as one, meaning that when we minus ten
from -128, it overflows.
So the - is set.
All right.
So the same.
So now, how do we, let's try to change this.
Now let's say we perform operation on the word instead of the byte.
See what happens.
So now we go back to -, modify this.
We put a value of positive 127.
Let's say this time we are going to add ten to see whether it overflows.
So we add, instead of -,
this time we use -.
We add ten to it, and - has a wider range, -32768 to positive 32767.
So it shouldn't overflow.
So let's try that.
Now we step over this, and we see the overflow is cleared.
That means overflow did not happen because the
word, which is two bytes, is large enough to accommodate 127 plus ten.
So that's why it didn't overflow.
So now let's try the reverse with minus.
Let's try -.
This time, modify the value and put a negative 128.
This time we are going to minus ten from - instead of -.
So now we subtract from - the value of negative ten.
And we step over.
So you notice the flag is cleared, meaning that there is no overflow.
This is how the - flag works in the x64dbg and assembly.
That's all for this video.
Thank you for watching.