Reversing : The Hacker's Guide to Reverse Engineering

It is not easy to define truly generic rules for reading compound condition-

als in assembly language, but the basic parameter to look for is the jump target

address of each one of the conditional branches. Conditions combined using

the ORoperator will usually jump directly to the conditional code block, and

their conditions will not be reversed (except for the last condition, which will

point to the code that follows the conditional block and will be reversed). In

contrast, conditions combined using the AND operator will tend to be

reversed and jump to the code block that follows the conditional code block.

When analyzing complex compound conditionals, you must simply use these

basic rules to try and figure out each condition and see how the conditions are

connected.

n-way Conditional (Switch Blocks)

Switch blocks(or n-way conditionals) are commonly used when different behavior

is required for different values all coming from the same operand. Switch blocks

essentially let programmers create tables of possible values and responses. Note

that usually a single response can be used for more than one value.

Compilers have several methods for dealing with switch blocks, depending

on how large they are and what range of values they accept. The following sec-

tions demonstrate the two most common implementations of n-way condi-

tionals: the table implementation and the tree implementation.

Table Implementation

The most efficient approach (from a runtime performance standpoint) for

large switch blocks is to generate a pointer table. The idea is to compile each of

the code blocks in the switchstatement, and to record the pointers to each

one of those code blocks in a table. Later, when the switch block is executed,

the operand on which the switch block operates is used as an index into that

pointer table, and the processor simply jumps to the correct code block. Note

that this is not a function call, but rather an unconditional jump that goes

through a pointer table.

The pointer tables are usually placed right after the function that contains the

switch block, but that’s not always the case—it depends on the specific com-

piler used. When a function table is placed in the middle of the code section,

you pretty much know for a fact that it is a ‘switch’block pointer table.

Hard-coded pointer tables within the code section aren’t really a common sight.

Figure A.11 demonstrates how an n-way conditional is implemented using

a table. The first case constant in the source code is 1 and the last is 5, so there

are essentially five different case blocks to be supported in the table. The

default block is not implemented as part of the table because there is no spe-

cific value that triggers it—any value that’s not within the 1–5 range will make

Deciphering Code Structures 499

21_574817 appa.qxd 3/16/05 8:52 PM Page 499