Reversing : The Hacker's Guide to Reverse Engineering

Figure A.11 A table implementation of a switch block.

The general idea is to divide the searchable items into two equally sized

groups based on their values and record the range of values contained in each

group. The process is then repeated for each of the smaller groups until the

individual items are reached. While searching you start with the two large

groups and check which one contains the correct range of values (indicating

that it would contain your item). You then check the internal division within

that group and determine which subgroup contains your item, and so on and

so forth until you reach the correct item.

Switch (ByteValue){

case

1:Case Specific Code...break;

case 2:

Case Specific Code...break;

case 3:

Case Specific Code...

case 4:

Case Specific Code...break;

case 5:

Case Specific Code...break;

default:

Case Specific Code...break;

};

Case1_CodeCase2_CodeCase3_CodeCase4_CodeCase5_Code

Pointer T

able

(PointerTableAddr)

Original Source

Code

Assembly Code Generated

for

Individual Cases

Case1_C

ode:

Case Specific Code...jmp AfterSwitchBlockCase2_Code:Case Specific Code...jmp AfterSwitchBlockCase3_Code:Case Specific Code...Case4_Code:Case Specific Code...jmp AfterSw

itchBlock

Case5_Code:Case Specific Code...jmp AfterSw

itchBlock

movzx eax, BYTE PTR [ByteValue]add DefaultCase_Code:Case Specific Code...jmp AfterSwitchBlock

eax, -1

cmp

ecx, 4

ja

DefaultCase_Code

jmp

DWORD PTR [PointerTableAddr + ecx * 4]

AfterSwitchBlock:...

Assembly Code Generated For Switch

Block

Deciphering Code Structures 501

21_574817 appa.qxd 3/16/05 8:54 PM Page 501