Reversing : The Hacker's Guide to Reverse Engineering

(ff) #1
Conditional Branches

Conditional branches are implemented using the Jccgroup of instructions.
These are instructions that conditionally branch to a specified address, based
on certain conditions. Jccis just a generic name, and there are quite a few dif-
ferent variants. Each variant tests a different set of flag values to decide
whether to perform the branch or not. The specific variants are discussed in
Appendix A.
The basic format of a conditional branch instruction is as follows:


Jcc TargetCodeAddress

If the specified condition is satisfied, Jccwill just update the instruction
pointer to point to TargetCodeAddress(without saving its current value). If
the condition is not satisfied, Jccwill simply do nothing, and execution will
proceed at the following instruction.


Function Calls

Function calls are implemented using two basic instructions in assembly lan-
guage. The CALLinstruction calls a function, and the RETinstruction returns
to the caller. The CALLinstruction pushes the current instruction pointer onto
the stack (so that it is later possible to return to the caller) and jumps to the
specified address. The function’s address can be specified just like any other
operand, as an immediate, register, or memory address. The following is the
general layout of the CALLinstruction.


CALL FunctionAddress

When a function completes and needs to return to its caller, it usually
invokes the RETinstruction. RETpops the instruction pointer pushed to the
stack by CALLand resumes execution from that address. Additionally, RETcan
be instructed to increment ESPby the specified number of bytes after popping
the instruction pointer. This is needed for restoring ESPback to its original
position as it was before the current function was called and before any para-
meters were pushed onto the stack. In some calling conventions the caller is
responsible for adjusting ESP, which means that in such cases RETwill be used
without any operands, and that the caller will have to manually increment
ESPby the number of bytes pushed as parameters. Detailed information on
calling conventions is available in Appendix C.


Low-Level Software 51
Free download pdf