Reverse Engineering for Beginners

CHAPTER 13. SWITCH()/CASE/DEFAULT CHAPTER 13. SWITCH()/CASE/DEFAULT

; print "8, 9, 21"

adrp x0, .LC2

add x0, x0, :lo12:.LC2

b puts

.L5:

; print "3, 4, 5"

adrp x0, .LC1

add x0, x0, :lo12:.LC1

b puts

.L3:

; print "1, 2, 7, 10"

adrp x0, .LC0

add x0, x0, :lo12:.LC0

b puts

.LC0:

.string "1, 2, 7, 10"

.LC1:

.string "3, 4, 5"

.LC2:

.string "8, 9, 21"

.LC3:

.string "22"

.LC4:

.string "default"

Let’s compile this example to object file and open it inIDA. Here is the jump table:

Listing 13.12: jumptable in IDA

.rodata:0000000000000064 AREA .rodata, DATA, READONLY

.rodata:0000000000000064 ; ORG 0x64

.rodata:0000000000000064 $d DCB 9 ; case 1

.rodata:0000000000000065 DCB 9 ; case 2

.rodata:0000000000000066 DCB 6 ; case 3

.rodata:0000000000000067 DCB 6 ; case 4

.rodata:0000000000000068 DCB 6 ; case 5

.rodata:0000000000000069 DCB 6 ; case 6

.rodata:000000000000006A DCB 9 ; case 7

.rodata:000000000000006B DCB 3 ; case 8

.rodata:000000000000006C DCB 3 ; case 9

.rodata:000000000000006D DCB 9 ; case 10

.rodata:000000000000006E DCB 0xF7 ; case 11

.rodata:000000000000006F DCB 0xF7 ; case 12

.rodata:0000000000000070 DCB 0xF7 ; case 13

.rodata:0000000000000071 DCB 0xF7 ; case 14

.rodata:0000000000000072 DCB 0xF7 ; case 15

.rodata:0000000000000073 DCB 0xF7 ; case 16

.rodata:0000000000000074 DCB 0xF7 ; case 17

.rodata:0000000000000075 DCB 0xF7 ; case 18

.rodata:0000000000000076 DCB 0xF7 ; case 19

.rodata:0000000000000077 DCB 3 ; case 20

.rodata:0000000000000078 DCB 3 ; case 21

.rodata:0000000000000079 DCB 0 ; case 22

.rodata:000000000000007B ; .rodata ends

So in case of 1, 9 is to be multiplied by 4 and added to the address of Lrtx4 label. In case of 22, 0 is to be multiplied by 4,

resulting in 0. Right after the Lrtx4 label is the L7 label, where you can find the code that prints “22”. There is no jump

table in the code segment, it’s allocated in a separate .rodata section (there is no special need to place it in the code section).

There are also negative bytes (0xF7), they are used for jumping back to the code that prints the “default” string (at .L2).

13.4 Fall-through.

Another very popular usage ofswitch()is the fall-through. Here is a small example:

1 #define R 1
2 #define W 2
3 #define RW 3