Checking some values

[dacid]

I need to check some values in some PE fields:

400
50

So EAX can be:

A3000
A3050
A3400
A3450 -> 400 + 50


I use:

cmp al,50h
jz this

and ax,1FFh
cmp ax,400h
jz that

But how to check for 400 if the value is 450 for example?

A3450 -> 400 + 50 (this+that)

and ax,1FFh
cmp ax,4xx?

:eek

[donkey]

0400h is an even binary power so you can check it with a simple test instruction

TEST EAX, 0400h

If the 0400h bit is set the zero flag will be clear, if not it will be set. There is no need to mask the register to check for 0400h, just check the high byte of AX (BTW the mask should have been AND AX, 0FF00h)

cmp al, 50h
jz this
cmp ah, 04h
jz that

[dacid]

Let me explain better...

attribute1    5
attribute2    8
attribute3   10
attribute4   50
attribute5  100
attribute6  200
attribute6  400
attribute7  800
attribute8 1000

How i can now what attributes are set?

mov ax,Attributtes

this can be any combination of previous mentioned values.

ax= 0005
ax= 0105 (100+5)
ax= 0450 (400+50)
ax= 1005 (1000+5)

I  tried like this:

.IF     (ax & 50h)

.IF     (ax & 100h)

.IF     (ax & 400h)

But is this the correct way?

[qWord]

hi dacid,

Code Select Expand

How i can now what attributes are set?

that's not possible. You have to use values that are binary powers:

Code Select Expand

attribute1 EQU 1        ; = 2^0 = 00000001y
attribute2 EQU 2        ; = 2^1 = 00000010y
attribute3 EQU 4        ; = 2^2 = 00000100y
attribute4 EQU 8        ; = 2^3 = 00001000y
attribute5 EQU 16       ; = 2^4 = 00010000y
attribute6 EQU 32       ; = 2^5 = 00100000y
attribute7 EQU 64       ; = 2^6 = 01000000y
attribute8 EQU 128      ; = 2^7 = 10000000y

    mov eax,attribute1 + attribute2

    .if eax & attribute1

    .elseif eax & attribute2

    ....

    .endif

regards qWord

[dacid]

Im confused... its not the same that this?

.IF     (eax & FILE_ATTRIBUTE_READONLY)


FILE_ATTRIBUTE_READONLY               equ 1h
FILE_ATTRIBUTE_HIDDEN                   equ 2h
FILE_ATTRIBUTE_SYSTEM                  equ 4h
FILE_ATTRIBUTE_DIRECTORY             equ 10h
FILE_ATTRIBUTE_ARCHIVE                 equ 20h
FILE_ATTRIBUTE_NORMAL                  equ 80h
FILE_ATTRIBUTE_TEMPORARY            equ 100h
FILE_ATTRIBUTE_COMPRESSED           equ 800h

[qWord]

I've misunderstood your previous post :red - Yes it it is the same

sorry for confusing you

regards qWord

[raymond]

If those are the only values you want to check,

So EAX can be:

A3000
A3050
A3400
A3450

Keep it simple.

Code Select Expand

and  eax,0FFFh   ;keeps the last three nibbles
jz   A3000
cmp  eax,50h
jz   A3050
cmp  eax,400h
jz   A3400
cmp  eax,450h
jz   A3450
...       ;code for none of the above

Regards