6

I'm trying to figure out what does this piece of code exactly:

  LODWORD(fMax) = *(_DWORD *)v12;
  HIDWORD(fMax) = v13;

I was reading on IDA\Plugins\defs.h the definition, but I don't understand what does exactly to redo the same thing on Java.

I'll be really really glad if someone of you can help me.

perror
  • 19,083
  • 29
  • 87
  • 150
Criss Moreyra
  • 99
  • 1
  • 2
  • 4
  • 3
    LODWORD() takes the low DWORD from fMax, and HIDWORD() the high DWORD. Basically, if you got an __int64 like this: x = 0xFFFFFFFFAAAAAAAA, LODWORD(x) is 0xAAAAAAAA and HIDWORD(x) is 0xFFFFFFFF – rev Feb 20 '15 at 01:27
  • So this two variables are basically changin the value of fMax. for example as you said, if i had fMax = 0xFFFFFFFFAAAAAAAA and v12 = 0xFFCD0000... the final value of LODWORD(fMax) would be 0xFFFFFFFFFFCD0000. i'm right? – Criss Moreyra Feb 20 '15 at 02:24
  • Yes, you're right. However, i assume you omitted a &, and the first expression should read ...*(_DWORD *) &v12, as you want to select the low 32 bits from v12, instead of treating v12 as a pointer. – Guntram Blohm Feb 20 '15 at 06:49

1 Answers1

7

This pattern is typical for assigning a 64-bit value to a variable on a 32 bit system - you calculate each 32-bit value separately, then push them into the high and low 32 bits of the 64 bit value.

In Java, your first assignment would be

fMax=(fMax & 0xFFFFFFFF00000000) | (v12 & 0x00000000FFFFFFFF)

and the second would be

fMax=(fMax & 0x00000000FFFFFFFF) | (((long)v13<<32) & 0xFFFFFFFF00000000)

Of course, fMax is a 64 bit long here.

You can omit the & 0xFFFFFFFF00000000 from the second expression, as you know those bits will be zero after the left shift. And you can omit the & 0x00000000FFFFFFFF from the first expression if v12 is an int, since the high bits will be zero anyway in a 32 bit integer. But the java compiler will probably optimize these away anyway, and i wanted to write the statements in a way that makes clear which bits are taken from fMax, and which from v12 and v13.

Guntram Blohm
  • 12,950
  • 2
  • 22
  • 32
  • Thank you, i've understood but now i found this SHIDWORD(v10) i assume this is something like do fMax = (fMax & 0xFFFFFFFF00000000) | (v10 + 1) i'm right? – Criss Moreyra Feb 22 '15 at 02:29
  • SHIDWORD is the sign extended HIDWORD. The SHIDWORD of a negative 32-bit value is FFFFFFFF, and the SHIDWORD of a positive 32-bit value is 0. The +1 does not apply to the value, as in your v10 + 1, it applies to the pointer - one DWORD after the one at the address of v10. – Guntram Blohm Feb 22 '15 at 06:40
  • 1
    How can I convert that in simple C code? IDA interpreted this mov [rsp+56], eax to this LODWORD(v1) = v2;, v1 goes to a unknown/undocumented function. – Biswapriyo Aug 04 '18 at 20:20