Jan 8 · 2 min read

xorpd has some riddle-like pieces of assembly code here. In this post, I’ll analyze this one.

May I present you the code:

`not      raxinc      raxneg      rax`

## Line 1: not rax

This op flips every single bit for the rax register, simple as that. This performs a bitwise not operation as you’d expect.

`; Some examples to illustrate not's behavior:mov rax, 0x0not rax; Here rax = 0xffffffffffffffffnot rax; Here rax = 0x0mov rax, 0x00ff005500aa; Now rax = 0x00ff005500aanot rax; Finally, rax here is equal to 0xffffff00ffaaff55`

## Line 2: inc rax

Even simpler than the last line, this one just increments rax by 1:

`mov rax, 0x0inc rax; Here rax = 0x0000000000000001mov rax, 0xffffffffffffffffinc rax; Here rax = 0x0`

## Line 3: neg rax

Now, here’s where the riddle unfolds: the neg op calculates the two’s complement… How? May you ask

Well, it turns out the two’s complement of a given value X can be obtained by performing a bitwise not operation on X, then adding one to the previous result:

`mov  rax, Xnot  raxinc  rax; rax = X's two's complement====================================================================mov  rax, Xneg  rax; rax = X's two's complement`

## Conclusion

If we run the instructions from the riddle in the presented order rax’s value wouldn't be changed after all as we would be doing something like:

`let n = 0x55n = twosComplement(twosComplement(n))print(n) // yields "0x55"`

By applying the two’s complement twice they cancel each other and we end up with the original value. This riddle shows us how the two’s complement is calculated and how it can be reversed!

Written by

## syscall59

#### Shellcode for the masses

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just \$5/month. Upgrade