x86 Software Reverse-Engineering, Cracking, and Counter-Measures

CHAPTER 7Functions and Control Flow

A program is a series of instructions, and an application may not move linearly from one instruction to the next. When reversing and cracking an application, it's vital to understand control flows and the various factors that can affect them, such as if statements and loops in higher-level languages.

When reversing a function in x86 or a higher-level language, you'll likely run into functions as well. This chapter also explores how functions work in x86 and their effects on the program stack.

Control Flow

So far, the assembly code that has been explored in this book has followed a sequential stream of instructions. Execution simply continues from top to bottom. However, most applications are not completely sequential. Consider the following code block:

if (x) {
       // Do something
}

When executing this code, the processor will evaluate the condition, x , and determine whether it is true. If so, it moves on to the instructions within the if block.

However, if the condition, x , is not true, then the instructions within the if block are skipped. This requires the ability to tell the processor to execute some instructions and not others, changing the flow of execution.

The Instruction Pointer

The eip register is known as the instruction pointer and holds the address of the next instruction to execute. The processor will automatically increment the value stored in eip after an instruction is executed.

Allowing eip to be incremented after ...