Reversing : The Hacker's Guide to Reverse Engineering

Figure A.9 High-level/low-level view of a conditional statement with three conditions

combined using a more efficient version of the ORoperator.

The idea is simple. When multiple ORoperators are used, the compiler will

produce multiple consecutive conditional jumps that each go to the condi-

tional block if they are satisfied. The last condition will be reversed and will

jump to the code right after the conditional block so that if the condition is met

the jump won’t occur and execution will proceed to the conditional block that

resides right after that last conditional jump. In the preceding sample, the final

check checks that Variable3doesn’t equal zero, which is why it uses JE.

Let’s now take a look at what happens when more than two conditions are

combined using the ANDoperator (see Figure A.10). In this case, the compiler

simply adds more and more reversed conditions that skip the conditional

block if satisfied (keep in mind that the conditions are reversed) and continue

to the next condition (or to the conditional block itself) if not satisfied.

Complex Combinations

High-level programming languages allow programmers to combine any num-

ber of conditions using the logical operators. This means that programmers

can create complex combinations of conditional statements all combined using

the logical operators.

if (Variable1 == 100 ||

Variable2 == 50 ||

Variable3 != 0)

SomeFunction();

...

cmp [Variable1], 100

je ConditionalBlock

cmp [Variable2], 50

je ConditionalBlock

cmp [Variable3], 0

je AfterConditionalBlock

ConditionalBlock:

call SomeFunction

AfterConditionalBlock:

...

Assembly Language Code High-Level Code

ReversedNot

Not

Reversed

Reversed

Deciphering Code Structures 497

21_574817 appa.qxd 3/16/05 8:52 PM Page 497