Reversing : The Hacker's Guide to Reverse Engineering

Figure A.10 High-level/low-level view of a compound conditional statement with three

conditions combined using the ANDoperator.

There are quite a few different combinations that programmers could use,

and I could never possibly cover every one of those combinations. Instead,

let’s take a quick look at one combination and try and determine the general

rules for properly deciphering these kinds of statements.

cmp [Variable1], 100

je ConditionalBlock

cmp [Variable2], 50

jne AfterConditionalBlock

cmp [Variable3], 0

je AfterConditionalBlock

ConditionalBlock:

call SomeFunction

AfterConditionalBlock:

...

This sample is identical to the previous sample of an optimized application

of the ORlogical operator, except that an additional condition has been added

to test whether Variable3equals zero. If it is, the conditional code block is

not executed. The following C code is a high-level representation of the pre-

ceding assembly language snippet.

if (Variable1 == 100 || (Variable2 == 50 && Variable3 != 0))

SomeFunction();

if (Variable1 == 100 &&

Variable2 == 50 &&

Variable3 != 0)

Result = 1;

...

cmp [Variable1], 100

jne AfterConditionalBlock

cmp [Variable2], 50

jne AfterConditionalBlock

cmp [Variable3], 0

je AfterConditionalBlock

mov [Result], 1

AfterConditionalBlock:

...

Assembly Language Code High-Level Code

Reversed

Reversed

Reversed

498 Appendix A

21_574817 appa.qxd 3/16/05 8:52 PM Page 498