Reversing : The Hacker's Guide to Reverse Engineering

Another common logical operator is the ORoperator, which is used for cre-

ating conditional statements that only require for one of the conditions speci-

fied to be satisfied. The ORoperator means that the conditional statement is

considered to be satisfied if either the first condition orthe second condition is

true. In C and C++, ORoperators are denoted using the ||symbol. Detecting

conditional statements containing ORoperators while reversing is slightly

more complicated than detecting AND operators. The straightforward

approach for implementing the ORoperator is to use a conditional jump for

each condition (without reversing the conditions) and add a final jump that

skips the conditional code block if neither conditions are met. Here is an exam-

ple of this strategy:

cmp [Variable1], 100

je ConditionalBlock

cmp [Variable2], 50

je ConditionalBlock

jmp AfterConditionalBlock

ConditionalBlock:

call SomeFunction

AfterConditionalBlock:

...

Figure A.6 demonstrates how the preceding snippet maps into the original

source code.

Figure A.6 High-level/low-level view of a compound conditional statement with two

conditions combined using the ORoperator.

if (Variable1 == 100 ||

Variable2 == 50)

SomeFunction();

...

cmp [Variable1], 100

je ConditionalBlock

cmp [Variable2], 50

je ConditionalBlock

jmp AfterConditionalBlock

ConditionalBlock:

call SomeFunction

AfterConditionalBlock:

...

Assembly Language Code High-Level Code

494 Appendix A

21_574817 appa.qxd 3/16/05 8:52 PM Page 494