if after the first step (u += 0xe91aaa35) you apply this function: invert = lambda x: ~int(hex(0xffffffff - x)[0:-1],16) it returns the correct value (corrected the overflow) but there is still something wrong, still looking into it, if someone knows how to do this, feel free to comment :)