Reverse Engineering for Beginners

CHAPTER 12. CONDITIONAL JUMPS CHAPTER 12. CONDITIONAL JUMPS

Here is the modified code:

Figure 12.8:Hiew: let’s modify thef_unsigned()function

If we miss to change any of these jumps, then severalprintf()calls may execute, while we want to execute only one.

Non-optimizing GCC

Non-optimizing GCC 4.4.1 produces almost the same code, but withputs()(3.4.3 on page 14) instead ofprintf().

Optimizing GCC

An observant reader may ask, why executeCMPseveral times, if the flags has the same values after each execution? Perhaps
optimizing MSVC can not do this, but optimizing GCC 4.8.1 can go deeper:

Listing 12.4: GCC 4.8.1 f_signed()

f_signed:
mov eax, DWORD PTR [esp+8]
cmp DWORD PTR [esp+4], eax
jg .L6
je .L7
jge .L1
mov DWORD PTR [esp+4], OFFSET FLAT:.LC2 ; "a<b"
jmp puts
.L6:
mov DWORD PTR [esp+4], OFFSET FLAT:.LC0 ; "a>b"
jmp puts
.L1:
rep ret
.L7:
mov DWORD PTR [esp+4], OFFSET FLAT:.LC1 ; "a==b"