x32dbg/x64dbg逆向之反汇编switch分析1反汇编switch分析如果咱们条件语句很少各位会发现一个有趣的问题它和if-else反汇编一摸一样但是如果分支条件多了很神奇会出现一个特殊的table。咱们看下switch在汇编中是什么表现x86和x64有什么区别以及DebugRelease又有什么区别2C语言案例代码咱们在学习逆向分析的同时同步梳理C和C基础知识点一正一反正向开发逆向分析为后续深耕底层技术打好基础哦。#includestdio.hvoid test(int x){switch (x){case 1:printf(%d, x);break;case 3:printf(%d, x);break;case 7:printf(%d, x);break;case 10:printf(%d, x);break;//Add this ?case 888:printf(%d, x);break;//Add this ?case 9999:printf(%d, x);break;/*?????001C1BCF je __$EncStackInitStart0A8h (01C1C44h)001C1BD1 cmp dword ptr [ebp-0C4h],1001C1BD8 je __$EncStackInitStart6Fh (01C1C0Bh)001C1BDA cmp dword ptr [ebp-0C4h],3001C1BE1 je __$EncStackInitStart82h (01C1C1Eh)001C1BE3 cmp dword ptr [ebp-0C4h],7001C1BEA je __$EncStackInitStart95h (01C1C31h)001C1BEC jmp __$EncStackInitStart0E1h (01C1C7Dh)001C1BF1 cmp dword ptr [ebp-0C4h],378h001C1BFB je __$EncStackInitStart0BBh (01C1C57h)001C1BFD cmp dword ptr [ebp-0C4h],270Fh001C1C07 je __$EncStackInitStart0CEh (01C1C6Ah)001C1C09 jmp __$EncStackInitStart0E1h (01C1C7Dh)*/default:printf(%d, 0);break;}}void test1(int x){switch (x){case 1:printf(%d, x);switch (x){case 1:printf(%d, x);break;case 3:printf(%d, x);break;case 7:printf(%d, x);break;default:printf(%d, 0);break;}break;case 3:printf(%d, x);switch (x){case 1:printf(%d, x);break;case 3:printf(%d, x);break;case 7:printf(%d, x);break;default:printf(%d, 0);break;}break;case 7:printf(%d, x);switch (x){case 1:printf(%d, x);break;case 3:printf(%d, x);break;case 7:printf(%d, x);break;default:printf(%d, 0);break;}break;break;case 10:printf(%d, x);switch (x){case 1:printf(%d, x);break;case 3:printf(%d, x);break;case 7:printf(%d, x);break;default:printf(%d, 0);break;}break;default:printf(%d, 0);switch (x){case 1:printf(%d, x);break;case 3:printf(%d, x);break;case 7:printf(%d, x);break;default:printf(%d, 0);break;}break;}}int main(){test(1);test1(7);}3单个switchx86Debug版本ds指向数据段全局/静态变量ss指向栈段局部变量反汇编时候有没有发现不同之处如果你使用分支语句小于四个时候肯定会发现很多jecmp指令但是分支语句一旦多了咱们就看不到多个jecmp了eax*4b.内存里面有个表记录着每一个分支语句地址004C1C76 | 8B45 08 | mov eax,dword ptr ss:[ebp8] | FileName.cpp:6读取函数传入的形参到eax寄存器004C1C79 | 8985 3CFFFFFF | mov dword ptr ss:[ebp-C4],eax | 复制给局部变量004C1C7F | 8B8D 3CFFFFFF | mov ecx,dword ptr ss:[ebp-C4] |004C1C85 | 83E9 01 | sub ecx,1 | 为什么要减一004C1C88 | 898D 3CFFFFFF | mov dword ptr ss:[ebp-C4],ecx |004C1C8E | 83BD 3CFFFFFF 09 | cmp dword ptr ss:[ebp-C4],9 | 09:\t,比较如果都没有比9大直接跳到Default004C1C95 | 77 60 | ja project1.$LN8 | 比较如果都比9大直接跳到Default分支004C1C97 | 8B95 3CFFFFFF | mov edx,dword ptr ss:[ebp-C4] |30 1D 4C 00 - 小端序反转 004C1D30索引表基址1C 1D 4C 00 - 小端序反转 004C1D1Ccase 地址跳转表基址004C1C9D | 0FB682 301D4C00 | movzx eax,byte ptr ds:[edx] | 从跳转索引表取出索引值零扩展后存入eax004C1CA4 | FF2485 1C1D4C00 | jmp dword ptr ds:[eax*4] | 通过eax*4计算的结果跳转到指定的case通过eax*4偏移跳转表基址跳转到对应case分支4C1D1C内存存储各case分支入口地址eax*4b.内存里面有个表记录着每一个分支语句地址004C1CAB | 8B45 08 | mov eax,dword ptr ss:[ebp8] | FileName.cpp:9读取函数传入的形参到eax寄存器004C1CAE | 50 | push eax |004C1CAF | 68 307B4C00 | push project1.%d... | 4C7B30:%d004C1CB4 | E8 19F4FFFF | call project1.4C10D2 | printf004C1CB9 | 83C4 08 | add esp,8 |004C1CBC | EB 48 | jmp project1.4C1D06 | FileName.cpp:10004C1CBE | 8B45 08 | mov eax,dword ptr ss:[ebp8] | FileName.cpp:12004C1CC1 | 50 | push eax |004C1CC2 | 68 307B4C00 | push project1.%d... | 4C7B30:%d004C1CC7 | E8 06F4FFFF | call project1.4C10D2 | printf004C1CCC | 83C4 08 | add esp,8 |004C1CCF | EB 35 | jmp project1.4C1D06 | FileName.cpp:13004C1CD1 | 8B45 08 | mov eax,dword ptr ss:[ebp8] | FileName.cpp:15004C1CD4 | 50 | push eax |004C1CD5 | 68 307B4C00 | push project1.%d... | 4C7B30:%d004C1CDA | E8 F3F3FFFF | call project1.4C10D2 |004C1CDF | 83C4 08 | add esp,8 |004C1CE2 | EB 22 | jmp project1.4C1D06 | FileName.cpp:16004C1CE4 | 8B45 08 | mov eax,dword ptr ss:[ebp8] | FileName.cpp:18004C1CE7 | 50 | push eax |004C1CE8 | 68 307B4C00 | push project1.%d... | 4C7B30:%d004C1CED | E8 E0F3FFFF | call project1.4C10D2 |004C1CF2 | 83C4 08 | add esp,8 |004C1CF5 | EB 0F | jmp project1.4C1D06 | FileName.cpp:19004C1CF7 | 6A 00 | push 0 | FileName.cpp:22004C1CF9 | 68 307B4C00 | push project1.%d... | 4C7B30:%d004C1CFE | E8 CFF3FFFF | call project1.4C10D2 |004C1D03 | 83C4 08 | add esp,8 |