Reversing : The Hacker's Guide to Reverse Engineering

Simple Combinations

What happens when any of the logical operators are used to specify more than

two conditions? Usually it is just a straightforward extension of the strategy

employed for two conditions. For GCC this simply means another condition

before the unconditional jump.

In the snippet shown in Figure A.8, Variable1and Variable2are com-

pared against the same values as in the original sample, except that here we

also have Variable3which is compared against 0. As long as all conditions

are connected using an ORoperator, the compiler will simply add extra condi-

tional jumps that go to the conditional block. Again, the compiler will always

place an unconditional jump right after the final conditional branch instruc-

tion. This unconditional jump will skip the conditional block and go directly to

the code that follows it if none of the conditions are satisfied.

With the more optimized technique, the approach is the same, except that

instead of using an unconditional jump, the last condition is reversed. The rest

of the conditions are implemented as straight conditional jumps that point to

the conditional code block. Figure A.9 shows what happens when the same

code sample from Figure A.8 is compiled using the second technique.

Figure A.8 High-level/low-level view of a compound conditional statement with three

conditions combined using the ORoperator.

if (Variable1 == 100 ||

Variable2 == 50 ||

Variable3 != 0)

SomeFunction();

...

cmp [Variable1], 100

je ConditionalBlock

cmp [Variable2], 50

je ConditionalBlock

cmp [Variable3], 0

jne ConditionalBlock

jmp AfterConditionalBlock

ConditionalBlock:

call SomeFunction

AfterConditionalBlock:

...

Assembly Language Code High-Level Code

496 Appendix A

21_574817 appa.qxd 3/16/05 8:52 PM Page 496