Reversing : The Hacker's Guide to Reverse Engineering

(ff) #1
For the purpose of this particular discussion a forloop is equivalent to a
pretested loop such as the ones discussed earlier.

Posttested Loops

So what kind of an effect do posttested loops implemented in the high-level
realm actually have on the resulting assembly language code if the compiler
produces posttested sequences anyway? Unsurprisingly—very little.
When a program contains a do...while()loop, the compiler generates a
very similar sequence to the one in the previous section. The only difference is
that with do...while() loops the compiler never has to worry about
whether the loop’s conditional statement is expected to be satisfied or not in
the first run. It is placed at the end of the loop anyway, so it must be tested any-
way. Unlike the previous case where changing the starting value of the counter
to an unknown value made the compiler add another check before the begin-
ning of the loop, with do...while()it just isn’t necessary. This means that
with posttested loops the logic is always placed after the loop’s body, the same
way it’s arranged in the source code.

Loop Break Conditions

A loop break condition occurs when code inside the loop’s body terminates the
loop (in C and C++ this is done using the breakkeyword). The breakkey-
word simply interrupts the loop and jumps to the code that follows. The fol-
lowing assembly code is the same loop you’ve looked at before with a
conditional breakstatement added to it:

mov eax, DWORD PTR [c]
mov ecx, DWORD PTR [array]
LoopStart:
cmp DWORD PTR [ecx+eax*4], 0
jne AfterLoop
mov DWORD PTR [ecx+eax*4], eax
add eax, 1
cmp eax, 1000
jl LoopStart
AfterLoop:

This code is slightly different from the one in the previous examples because
even though the counter originates in an unknown source the condition is only
checked at the end of the loop. This is indicative of a posttested loop. Also, a
new check has been added that checks the current array item before it is

506 Appendix A

21_574817 appa.qxd 3/16/05 8:54 PM Page 506

Free download pdf