Reversing : The Hacker's Guide to Reverse Engineering

Predicated Execution

Using arithmetic sequences to implement branchless logic is a very limited

technique. For more elaborate branchless logic, compilers employ conditional

instructions(provided that such instructions are available on the target CPU

architecture). The idea behind conditional instructions is that instead of hav-

ing to branch to two different code sections, compilers can sometimes use spe-

cial instructions that are only executed if certain conditions exist. If the

conditions aren’t met, the processor will simply ignore the instruction and

move on. The IA-32 instruction set does not provide a genericconditional exe-

cution prefix that applies to all instructions. To conditionally perform opera-

tions, specific instructions are available that operate conditionally.

Certain CPU architectures such as Intel’s IA-64 64-bit architecture actually allow

almost any instruction in the instruction set to execute conditionally. In IA-64

(also known as Itanium2) this is implemented using a set of 64 available

predicate registers that each store a Boolean specifying whether a particular

condition is True or False. Instructions can be prefixed with the name of one of

the predicate registers, and the CPU will only execute the instruction if the

register equals True. If not, the CPU will treat the instruction as a NOP.

The following sections describe the two IA-32 instruction groups that enable

branchless logic implementations under IA-32 processor.

Set Byte on Condition (SETcc)

SETccis a set of instructions that perform the same logical flag tests as the

conditional jump instructions (Jcc), except that instead of performing a jump,

the logic test is performed, and the result is stored in an operand. Here’s a

quick example of how this is used in actual code. Suppose that a programmer

writes the following line:

return (result != FALSE);

In case you’re not entirely comfortable with C language semantics, the only

difference between this and the following line:

return result;

is that in the first version the function will always return a Boolean. If result

equals zero it will return one. If not, it will return zero, regardless of what

value resultcontains. In the second example, the return value will be what-

ever is stored in result.

Deciphering Code Structures 513

21_574817 appa.qxd 3/16/05 8:54 PM Page 513