Reversing : The Hacker's Guide to Reverse Engineering

Figure A.1 High-level/low-level view of a single branch conditional sequence.

Two-Way Conditionals

Another fundamental functionality of high-level languages is to allow the use

of two-way conditionals, typically implemented in high-level languages using

the if-elsekeyword pair. A two-way conditional is different from a single-

branch conditional in the sense that if the condition is not satisfied, the pro-

gram executes an alternative code block and only then proceeds to the code

that follows the ‘if-else’statement. These constructs are called two-way

conditionals because the flow of the program is split into one of two different

possible paths: the one in the ‘if’block, or the one in the ‘else’block.

Let’s take a quick look at how compilers implement two-way conditionals.

First of all, in two-way conditionals the conditional branch points to the

‘else’block and not to the code that follows the conditional statement. Sec-

ond, the condition itself is almost always reversed (so that the jump to the

‘else’block only takes place when the condition is not satisfied), and the

primary conditional block is placed right after the conditional jump (so that

the conditional code gets executed if the condition is satisfied). The conditional

block always ends with an unconditional jump that essentially skips the

‘else’block—this is a good indicator for identifying two-way conditionals.

The ‘else’block is placed at the end of the conditional block, right after that

unconditional jump. Figure A.2 shows what an average if-elsestatement

looks like in assembly language.

if (SomeVariable == 0)

CallAFunction();

...

mov eax, [SomeVariable]

test eax, eax

jnz AfterCondition

call CallAFunction

AfterCondition:

...

Assembly Language Code High-Level Code

Deciphering Code Structures 489

21_574817 appa.qxd 3/16/05 8:52 PM Page 489