Reversing : The Hacker's Guide to Reverse Engineering

Figure A.4 High-level/low-level view of conditional code with multiple alternate

execution paths.

Logical Operators

High-level languages have special operators that allow the use of compound con-

ditionals in a single conditional statement. When specifying more than one con-

dition, the code must specify how the multiple conditions are to be combined.

The two most common operators for combining more than one logical state-

ments are AND and OR (not to be confused with the bitwise logic operators).

As the name implies, AND(denoted as &&in C and C++) denotes that two

statements must be satisfied for the condition to be considered true. Detecting

such code in assembly language is usually very easy, because you will see two

if (SomeVariable < 10)

SomeFunction();

else if (SomeVariable == 345)

SomeOtherFunction();

else if (SomeVariable == 346)

AnotherFunction();

else if (SomeVariable == 347)

YetAnotherFunction();

cmp [Variable1], 10

jae AlternateBlock1

call SomeFunction

jmp AfterIfBlock

AlternateBlock1:

cmp [Variable1], 345

jne AlternateBlock2

call SomeOtherFunction

jmp AfterIfBlock

AlternateBlock2:

cmp [Variable1], 346

jne AlternateBlock3

call AnotherFunction

jmp AfterIfBlock

AlternateBlock3:

cmp [Variable1], 347

jne AfterIfBlock

call YetAnotherFunction

AfterIfBlock:

...

Assembly Language Code High-Level Code

Reversed

Reversed

Reversed

Reversed

492 Appendix A

21_574817 appa.qxd 3/16/05 8:52 PM Page 492