Reversing : The Hacker's Guide to Reverse Engineering

consecutive conditions that conditionally branch to the same address. Here is

an example:

cmp [Variable1], 100

jne AfterCondition

cmp [Variable2], 50

jne AfterCondition

ret

AfterCondition:

...

In this snippet, the revealing element is the fact that both conditional jumps

point to the same address in the code (AfterCondition). The idea is simple:

Check the first condition, and skip to end of the conditional block if not met. If the

first condition is met, proceed to test the second condition and again, skip to the

end of the conditional block if it is not met. The conditional code block is placed

right after the second conditional branch (so that if neither branch is taken you

immediately proceed to execute the conditional code block). Deciphering the

actual conditions is the same as in a single statement condition, meaning that

they are also reversed. In this case, testing that Variable1doesn’t equal 100

means that the original code checked whether Variable1equals 100. Based on

this information you can reconstruct the source code for this snippet:

if (Variable1 == 100 && Variable2 == 50)

return;

Figure A.5 demonstrates how the above high-level code maps to the assem-

bly language code presented earlier.

Figure A.5 High-level/low-level view of a compound conditional statement with two

conditions combined using the AND operator.

if (Variable1 == 100 &&

Variable2 == 50)

return;

...

cmp [Variable1], 100

jne AfterCondition

cmp [Variable2], 50

jne AfterCondition

ret

AfterCondition:

...

Assembly Language Code High-Level Code

Deciphering Code Structures 493

21_574817 appa.qxd 3/16/05 8:52 PM Page 493