WEBVTT 1 00:00.800 --> 00:02.060 Hello and welcome. 2 00:02.090 --> 00:10.760 In this lesson, we are going to study how the AND, OR, and XOR instructions affect the flags, particularly 3 00:10.760 --> 00:13.400 the zero flag, 4 00:13.520 --> 00:14.900 the sign flag. 5 00:16.100 --> 00:18.080 Now for all three instructions, 6 00:18.080 --> 00:25.730 it does not affect the overflow flag or the carry flag, but it affects or modifies the sign flag or 7 00:25.730 --> 00:32.000 the zero flag depending on the value that is the result of the execution. 8 00:33.020 --> 00:35.660 So let's take a look at a practical example. 9 00:35.660 --> 00:39.740 Now we are going to use the x64dbg. 10 00:41.780 --> 00:45.230 I have loaded the template 2x into x64dbg. 11 00:46.130 --> 00:51.380 So let's go to our code here and enter this value. 12 01:01.030 --> 01:01.300 Hit 13 01:01.300 --> 01:01.960 okay. 14 01:02.770 --> 01:06.490 Now we are going to AND this value with zero. 15 01:19.010 --> 01:24.260 So this value converts into 0x88. 16 01:25.790 --> 01:29.690 So we can confirm that by using our programmer's calculator. 17 01:33.840 --> 01:37.620 If we enter, we set this to byte. 18 01:40.060 --> 01:43.870 And here we set this hex to 88. 19 01:44.830 --> 01:51.760 And we can see that in binary it is 10001000, which is this number here. 20 01:52.270 --> 01:55.180 So now we are going to AND this number with a zero. 21 01:55.180 --> 01:58.540 So the result will be stored back into -. 22 01:58.810 --> 02:00.730 And the result should be zero. 23 02:02.280 --> 02:05.640 Because when you AND anything with zero, you get back a zero. 24 02:06.180 --> 02:13.290 So because the result's most significant bit is zero, it will be interpreted as a positive number. 25 02:14.100 --> 02:18.900 So since it is interpreted as a positive number, the sign flag will be cleared. 26 02:19.560 --> 02:23.670 And then because the result is zero, the zero flag will be set. 27 02:25.370 --> 02:28.250 So let's step into it now. 28 02:28.280 --> 02:29.900 We run to our breakpoint. 29 02:30.410 --> 02:31.490 Step over. 30 02:33.650 --> 02:38.240 And we see that indeed the zero flag is set, but the sign flag is clear. 31 02:39.260 --> 02:42.830 Next, we will take a look at the OR example. 32 02:43.010 --> 02:46.160 So we will move this value into -. 33 02:48.080 --> 02:50.120 So let's move into -. 34 02:59.290 --> 03:01.810 Next, we are going to OR with all ones. 35 03:10.780 --> 03:12.790 So what do you expect to get? 36 03:13.240 --> 03:22.810 So what you get is after this operation is that the result will be non-zero. 37 03:22.810 --> 03:28.630 So non-zero means that the zero flag will be cleared, because the significant bit is going to be one. 38 03:28.630 --> 03:33.520 Therefore, the sign flag will be set because it will be interpreted as a negative number. 39 03:34.450 --> 03:35.980 So let's step over that now. 40 03:38.250 --> 03:42.030 And indeed, we see zero flag is cleared and the sign flag is set. 41 03:43.380 --> 03:47.040 Okay, for the last one, we are going to XOR -. 42 03:47.610 --> 03:48.930 So let's try that now. 43 03:54.470 --> 03:57.560 When you XOR, the result will always be zero. 44 03:58.430 --> 04:00.290 So what do you expect to see in zero flag, 45 04:00.290 --> 04:00.530 sign 46 04:00.530 --> 04:01.310 flag? 47 04:02.060 --> 04:03.080 Let's run and see. 48 04:05.050 --> 04:12.040 So zero flag is set because the result of a XOR on the register with itself will always be a zero, 49 04:12.790 --> 04:15.850 and the sign flag is set to zero because the result is zero. 50 04:15.880 --> 04:21.610 Therefore, the most significant bit is zero, meaning that it is a positive number. 51 04:22.210 --> 04:27.940 So the sign flag is zero. So only if it's a negative number, the sign flag will be set; otherwise, it 52 04:27.940 --> 04:28.630 will be zero. 53 04:29.530 --> 04:35.860 And as we have studied before, whether or not the number is positive or negative depends on the 54 04:35.860 --> 04:37.120 most significant bit. 55 04:37.570 --> 04:39.700 If the most significant bit is one, 56 04:39.700 --> 04:44.470 then it is interpreted as a negative number and the sign flag will be set. 57 04:45.220 --> 04:52.090 However, if the most significant bit is zero, it will be interpreted as a positive number and the 58 04:52.090 --> 04:53.410 sign flag will be cleared. 59 04:54.460 --> 04:56.170 So that's all for this video. 60 04:56.170 --> 04:57.430 Thank you for watching.