User: jinglz

Hydan works.

On: Program Hides Secret Messages in Executables

From the intel instruction set manual:
"The SUB instruction ... sets the CF flags to indicate an overflow in the unsigned result".

Which means that the CF stays the same for both instructions since their results are the same.

ADD EAX, 3 ; eax = eax + 3

Is the same as:

SUB EAX, -3 ; eax = eax - (-3)

So, "Hydan" works.
-j