Watching negative numbers?

[Nate523]

Hi,

new to learning assembly, I am doing an example that has me step into the code and then use the watch window of Visual Studio 2022's to see that the value stored in RCX register is changed from 50 to -50 by using the NEG instruction.

Here is the code :

Code Select Expand


INCLUDELIB kernel32.lib
ExitProcess PROTO
.data

var QWORD 99                            ; initialize variable mem

.code
mainCRTStartup PROC

XOR RCX, RCX                            ; Clear registry, RCX = 0
XOR RDX, RDX                            ; Clear registry, RCX = 0
INC var                    ; Increment var by 1, var = 100
MOV RCX, 51                ; Assign reg/imm, RCX = 51
DEC RCX                        ; Decrement RCX by 1, RCX = 50
NEG RCX                    ; Negate RCX, RCX = -50

MOV RCX, 78                            ; Did it exit afterwards?

call ExitProcess
mainCRTStartup ENDP
END


I then use the debugger, the exampe has me watch RCX, RDX, var, and also a "CL,bb", CL is the 8 bit least significant portion of RCX register correct? I do not recognize nor does the example explain what the 'bb' stands for. When I get the binary value of the 'CC,bb' the example has me drag the binary value into another watch item, which I am supposed to see -50 when I do so, but when I do it, it shows me -15474, which seems to be the value that was there before for that item. I attached a photo to show what I am seeing.

You cannot view this attachment.

Any ideas what I might be doing wrong to not see the signed value? For reference this example is from the book "Microsoft Assembly x64 Programming" in easy steps by Mike McGrath. Just learning assembly as a hobby to understand the CPU better and the gap between assembly and languages such as C/C++.

Thanks!

[zedd151]

"CL,bb"... seems some context is missing. I do not have the book, so I cannot look there.

[NoCforMe]

No idea what CL,bb means, but one thing: if RCX contains -50, CL will definitely not contain that value; the negative number depends on the high bit (in this case bit 63) being set. The value doesn't translate down to the least-significant byte (CL).

[Nate523]

See if I can clarify the mystery maybe. The "CL,bb" I am referring to is in the Watch window during debugging in Visual Studio 2022, so far it looks like the 'bb' portion just shows binary value of the register rather than its numerical value because when I do RCX,bb it shows the binary value of RCX.

The book is having me step through the instructions via the debugger watching the registers with the Watch window, but when I execute the:

Code Select Expand

NEG RCX
portion of the code, it says to drag the value of the 'CL,bb' in the Watch window to the "Add item to watch" area, and it is supposed to show the signed value of RCX = -50 which they have a picture of showing it and sure enough it says -50 in their image. However, when I do it, I get -15474 which is confusing because the binary value I drag is "11001110" which is 206... so either I am not dragging and dropping correctly, or RCX is not getting negated, or some other newbie issue is occurring that is not apparent to me.

No idea what CL,bb means, but one thing: if RCX contains -50, CL will definitely not contain that value; the negative number depends on the high bit (in this case bit 63) being set. The value doesn't translate down to the least-significant byte (CL).

Confusing how the book has me look at CL then... so after I use the instruction as the image shows, RCX contains instead of the value 50 it turns into this : 18446744073709551566, which is also in their image, so I figured it was normal, maybe it isn't?

Tried to attach a better photo of the watch window

[NoCforMe]

You need a better understanding of binary arithmetic:

-50 (signed) = 4,294,967,246 (unsigned decimal)
             = FFFFFFFFFFFFFFCE (hex)

Separating the low byte (CL):

CE (hex) = 206 (unsigned decimal)
         = 11001110 (binary)

Which is what you see on the display for CL,bb, whatever that means.

I'm not sure what the book was getting at by telling you to look at CL for the value of the entire register, RCX. As I said, the two will never show the same value if the full register value is negative.
One thing to reduce confusion here: the numbers I gave you were from my little calculator which is limited to 32 bits, so I'm pretty sure that 18446744073709551566 is the unsigned decimal value of -50 in a 64-bit register. The CE hex value of the low byte is the same regardless.

[Nate523]

You need a better understanding of binary arithmetic:

-50 (signed) = 4,294,967,246 (unsigned decimal)
             = FFFFFFFFFFFFFFCE (hex)

Separating the low byte (CL):

CE (hex) = 206 (unsigned decimal)
         = 11001110 (binary)

Which is what you see on the display for CL,bb, whatever that means.

I'm not sure what the book was getting at by telling you to look at CL for the value of the entire register, RCX. As I said, the two will never show the same value if the full register value is negative.
One thing to reduce confusion here: the numbers I gave you were from my little calculator which is limited to 32 bits, so I'm pretty sure that 18446744073709551566 is the unsigned decimal value of -50 in a 64-bit register. The CE hex value of the low byte is the same regardless.

Okay, at least the values are making some sense then because there's another window I can look at and the hex value for RCX is indeed:

RCX = FFFFFFFFFFFFFFCE

Thank you for the last bit too because I was wondering why it was RCX = 18446744073709551566 and the difference between 32 bit and 64 bit in containing signed numbers I didn't understand before you mentioned it. I'm also confused as to what the books is referring too and thought maybe it was just a mistake on my end of configuring the watch window appropriately. This has helped though because now I can at least use the Windows calculator in programming mode to check hex values and such to see if the register actually has the number I put into it. Not sure why they have me view CL register.

[NoCforMe]

the difference between 32 bit and 64 bit in containing signed numbers

In 32-bit land, -50 is FFFFFFCE. In 64-bit land it's FFFFFFFFFFFFFFCE. Two completely different numbers (at least in their unsigned values).

[Nate523]

the difference between 32 bit and 64 bit in containing signed numbers

In 32-bit land, -50 is FFFFFFCE. In 64-bit land it's FFFFFFFFFFFFFFCE. Two completely different numbers (at least in their unsigned values).

Ahhh, and I am playing in 64 bit land, chalk that to more stuff I need to learn about and keep in my head.

[sinsi]

Separating the low byte (CL):

CE (hex) = 206 (unsigned decimal)
         = 11001110 (binary)

206 unsigned byte is -50 signed

CL,bb is a formatting option in the watch window. If you click "Add watch" and type in CL, when you type the comma it will bring up a list of formats. I didn't know about that, so thanks

[NoCforMe]

206 unsigned byte is -50 signed

Thanks for the correction. Indeed it is. So I was wrong; as long as the value doesn't exceed the maximum (in the case of a negative number, minimum) value of an signed byte (-128), the byte register (CL) will contain the same value as the whole register (RCX). -50 will work, but -300 won't.

[zedd151]

CL,bb is a formatting option in the watch window. If you click "Add watch" and type in CL, when you type the comma it will bring up a list of formats. I didn't know about that, so thanks

Mystery solved, for this at least. Thanks, sinsi.

Must be hard (for a newcomer) to learn 64 bit assembly, and how to use Visual Studio concurrently. @Nate523, Visual Studio is overkill, imo. It only adds complexity to an already complex endeavor (learning 64 bit assembly).

[Nate523]

I think the problem is mostly solved and explained :

Separating the low byte (CL):

CE (hex) = 206 (unsigned decimal)
         = 11001110 (binary)

206 unsigned byte is -50 signed

CL,bb is a formatting option in the watch window. If you click "Add watch" and type in CL, when you type the comma it will bring up a list of formats. I didn't know about that, so thanks

This answer basically answered it along with some other responses so thanks all. Still leaves the mystery of how the book author managed to make it show the actually decimal value of "-50" they literally have an image of the watch window doing it, but with some mind rending with the whole 32-bit versus 64-bit differences I can at least now step through the code and see what's in the register that I am interested in, so the discussion has been very helpful and I appreciate it. I'm still learning GDB and its interface, maybe it would've helped this situation better, I don't know, command line stuff was causing problems with other programs I have that got solved in another thread while trying to solve other VS.Net stuff.

Overall, I was learning, that's all that mattered to me, so thanks for the discussion!

[NoCforMe]

Overall, I was learning, that's all that mattered to me, so thanks for the discussion!

Well, that's what matters to us too.

[daydreamer]

For 32 its great with qeditor with several help files:,mnemonics list, basic masm, macro list and a fourth
Do there exist 64 bit help files or should someone create those?
Visual studio has its advantages, it has intellisense and good built-in debugger needed for newbie to singlestep to understand CPU but also experts to debug code that produces wrong results or behave wrong

[kkurkiewicz]

The VS debugger allows you to observe any valid expression.
If the type of the register ends up being recognized as "unsigned short", try casting it to "short", i.e. change "CL" to "(short) CL".