Reverse Engineering for Beginners

CHAPTER 13. SWITCH()/CASE/DEFAULT CHAPTER 13. SWITCH()/CASE/DEFAULT

la $a0, ($LC1 & 0xFFFF) # "one" ; branch delay slot

sub_94: # DATA XREF: .rodata:00000128
; print "two" and finish
lui $a0, ($LC2 >> 16) # "two"
lw $t9, (puts & 0xFFFF)($gp)
or $at, $zero ; NOP
jr $t9
la $a0, ($LC2 & 0xFFFF) # "two" ; branch delay slot

; may be placed in .rodata section:
off_120: .word sub_6C
.word sub_80
.word sub_94
.word sub_44
.word sub_58

The new instruction for us is SLTIU (“Set on Less Than Immediate Unsigned”). This is the same as SLTU (“Set on Less Than
Unsigned”), but “I” stands for “immediate”, i.e., a number has to be specified in the instruction itself.

BNEZ is “Branch if Not Equal to Zero”.

Code is very close to the otherISAs. SLL (“Shift Word Left Logical”) does multiplication by 4. MIPS is a 32-bit CPU after all,
so all addresses in thejumptableare 32-bit ones.

13.2.5 Conclusion.

Rough skeleton ofswitch():

Listing 13.9: x86

MOV REG, input
CMP REG, 4 ; maximal number of cases
JA default
SHL REG, 2 ; find element in table. shift for 3 bits in x64.
MOV REG, jump_table[REG]
JMP REG

case1:
; do something
JMP exit
case2:
; do something
JMP exit
case3:
; do something
JMP exit
case4:
; do something
JMP exit
case5:
; do something
JMP exit

default:

...

exit:

....

jump_table dd case1
dd case2
dd case3
dd case4
dd case5

The jump to the address in the jump table may also be implemented using this instruction:JMP jump_table[REG4].
OrJMP jump_table[REG8]in x64.