Reverse Engineering for Beginners

CHAPTER 18. ARRAYS CHAPTER 18. ARRAYS

And that’s why to pick a specific element,month∗ 8 bytes has to be skipped from the start. That’s whatMOVdoes. In

addition, this instruction also loads the element at this address. For 1, an element would be a pointer to a string that

contains “February”, etc.

Optimizing GCC 4.9 can do the job even better^11 :

Listing 18.10: Optimizing GCC 4.9 x64

movsx rdi, edi

mov rax, QWORD PTR month1[0+rdi*8]

ret

32-bit MSVC

Let’s also compile it in the 32-bit MSVC compiler:

Listing 18.11: Optimizing MSVC 2013 x86

_month$ = 8
_get_month1 PROC
mov eax, DWORD PTR _month$[esp-4]
mov eax, DWORD PTR _month1[eax*4]
ret 0
_get_month1 ENDP

The input value does not need to be extended to 64-bit value, so it is used as is. And it’s multiplied by 4, because the table
elements are 32-bit (or 4 bytes) wide.

18.5.2 32-bit ARM.

ARM in ARM mode

Listing 18.12: Optimizing Keil 6/2013 (ARM mode)

get_month1 PROC
LDR r1,|L0.100|
LDR r0,[r1,r0,LSL #2]
BX lr
ENDP

|L0.100|
DCD ||.data||

DCB "January",0

DCB "February",0

DCB "March",0

DCB "April",0

DCB "May",0

DCB "June",0

DCB "July",0

DCB "August",0

DCB "September",0

DCB "October",0

DCB "November",0

DCB "December",0

AREA ||.data||, DATA, ALIGN=2
month1
DCD ||.conststring||
DCD ||.conststring||+0x8
DCD ||.conststring||+0x11
DCD ||.conststring||+0x17
DCD ||.conststring||+0x1d
DCD ||.conststring||+0x21
DCD ||.conststring||+0x26
DCD ||.conststring||+0x2b

(^11) “0+” was left in the listing because GCC assembler output is not tidy enough to eliminate it. It’sdisplacement, and it’s zero here.