Cheat Engine

dlpb · Posted: Fri Jan 26, 2018 1:15 am Post subject: Bug: and FFFFFFFF

when using "and FFFFFFFF" Cheat Engine insists on using "And FF" - which is not the same thing. Ex: And eax, FFFFFFFF

Dark Byte · Posted: Fri Jan 26, 2018 3:23 am Post subject:

And have you checked the result of EAX after execution ? It's possible it's using the size sign extended version of the instruction (where it takes an 8 bit value and sign extend it based on the most significant bit), which does exactly the same, but takes less bytes

OldCheatEngineUser · Jul 26, 2020

whats the size of the register?
and CE assembles:

dlpb · Posted: Sat Jan 27, 2018 8:37 pm Post subject:

When you are dealing with masks, surely FF FF FF FF is not at all the same as FF, which will be seen as 00 00 00 FF? This will mask out the first 24 bits but not the last (reverse order).

I didn't check the result, so perhaps the compiler does a trick where it doesn't care. But if that's the case, how would I add a mask of 00 00 00 FF? Will CE always default to FF?

The size of the register is obvious. I told you it was eax.

FreeER · Posted: Sat Jan 27, 2018 9:48 pm Post subject:

I think it's just a special version of and, see these variously assembled versions (x86 tutorial, not sure if these change at all in x64 but I know some do so...)

dlpb · Posted: Sat Jan 27, 2018 11:19 pm Post subject:

Thanks! CE also allows 000000FF if that's what is entered literally. Still, I'd think entering 'and eax,FF' into CE should yield the above value and not a version of "FFFFFFFF".

TheyCallMeTim13 · Posted: Sun Jan 28, 2018 12:41 am Post subject:

Because you're using a registry as an operand, the immediate gets turned in to the same size as the registry, this is common/expected behavior in assemblers.