- Switch cases are compiled into different styles, depending on the compiler, optimization settings, and case values
- may look like nested if..else if..else if..else..
- may use a jump table array
- For a jump table, the case is translated into an index within the table and multipled by the size of a pointer.
mov edx, [ebp+var_18]
jmp ds:off_401328[edx*4]
- Analysts are faced with many paths that are never visited
- Understanding the input and desired output can help to avoid unnecessary analysis
Like this:
Like Loading...
Related
Reverse Engineering, Malware Deep Insight 