Another subnetting calculation question...Scott?

Okay, I've learned how to take an IP address and mask and determine
the network address.  I know 2 methods:  The "Magic Number" easy
method from Odom's videos, and the binary AND method which I use to
check my answer.

So then we move on to determining the broadcast address, as well as
host range.  We learned yet another "Magic Number" method:  Magic
Number plus relevant octet of network address, minus 1.

Example:

Mask:       255.255.224.0
IP:           128.200.100.100
Network: 128.200.96.0  (Easy:  256 - 224 = 32.  96 is the multiple of
32 without going over 100, so it's 96).  Binary ANDing 224 and 100 is
just as easy.

1st usable host IP:  128.200.96.1.  Again, simple.  Network address
+1.

Now:  We're taught that to find the broadcast address, take 96, add
the magic number (32) = 128, subtract 1, and we get 127.

Simple enough to memorize, but doesn't satisfy me.
How do we get there the "hard" way, without using a formula?

I'm assuming there's a binary method to get from the network or IP
address to the broadcast address?