Steinar H. Gunderson: Decompilation patterns, part 4: range comparison

Today, we're looking at a rewrite that rarely differs for matching, but can mean quite a lot for understanding the code. Say that you have a signed variable and the compiler has suddenly decided to make an unsigned comparison: if ((u32) (x – 4) < 2) { What's happening is that it uses a controlled overflow to do two signed comparisons using one unsigned comparison. How does this work? Since the comparison is unsigned, this is trivially equivalent to the…

Quelle: Originalartikel öffnen