2

Movsx sign-extends a register with 1 right?

So why in Ollydbg i got this :

  • Before: before
  • After: after

I should have FFFFFF65 instead of 00000065 in ECX no?

Thank you !

Seki
  • 11,135
  • 7
  • 46
  • 70
Duke Nukem
  • 319
  • 4
  • 15
  • 2
    It extends the sign bit, which is the most significant bit. That's only 1 for negative numbers. – Jester Nov 12 '15 at 11:30
  • The src memory operand `byte ptr ds:[429d5d]` says to the assembler that you intend to load a byte from `ds:[429d5d]`. Since `MOVSX` sign extends the src operand, it will look at that high bit of the byte and replicate it through the higher bits (sign extend it). 0x65 MSB(most significant bit) is 0, so it was sign extended 0. a value 0x80 to 0xFF will be sign extended with a value of 1 to the upper bits because the MSB in that range is 1. Had you been dealing with WORD PTR then the sign extension would be based on the MSB of a 16-bit word – Michael Petch Nov 17 '15 at 16:28

1 Answers1

3

The byte at the memory location has the value 65h. This is a positive number and thus the extension will fill the 3 highest bytes of ECX with zero giving 00000065h .

Fifoernik
  • 9,779
  • 1
  • 21
  • 27