Assembler IF Statement

[chrisdudeperson]

Hi guys,

Rather new to assembler so please excuse my lack of knowledge

I am looking at a disassembled program and have come across an IF statement that has translated to psuedo code like this:

Code Select Expand


if (*(eax + 0x8) != 0x0)


Now, does this mean that if the value stored at memory location eax+0x8 is not equal to 0x0 then the if statement will be executed?

Cheers
Chris

[jj2007]

Hi Chris,

Apparently, yes, although this is not standard MASM notation. Which disassembler are you using?

Masm syntax would be
.if dword ptr [eax + 8] != 0
or
.if dword ptr [eax + 8]

P.S.: Welcome to the forum :icon14:

[Gunther]

Hi chrisdudeperson,

it looks like AT&T syntax. And welcome to the forum.

Gunther

[chrisdudeperson]

Thanks for the warm welcome!

I'm using hopper to dissemble a unix executable that runs on a mac

Is there a better disassembler that you could recommend?

[Vortex]

Hi Chris,

In the Windows world, I would recommend OllyDbg :

http://www.ollydbg.de/

[jj2007]

Yes, Olly is really good. I had Hopper installed but found it almost useless. Besides, when uninstalling, it left a lot of crap in the registry :(

[chrisdudeperson]

Ok I'll try Ollydbg with the Windows version of the program

I'm fairly sure the if statement in question is a true or false. I believe it is currently set to false with 0x0. What hex value would I have to use to make it true?

[FORTRANS]

Hi,

   Strictly, the values for TRUE and FALSE are determined by the
program(mer).  However, in practice False is defined to be zero,
and True is non-zero.  Common practice is to use zero and minus
one.  Minus one, with two's complement arithmetic, sets all bits
(sets the bits to ones).  So 0H and 0FFFFFFFFH would be used in
most cases when using double word values.

HTH,

Steve N.

[jj2007]

Common practice is to use zero and minus one.

Depends on the language and context. Unfortunately, C/C++ and Windows have chosen 1 instead of -1, and Masm32 has adopted that:

include \masm32\include\masm32rt.inc

.code
start:   MsgBox 0, str$(TRUE), "True:", MB_OK
   exit

end start

[hutch--]

The values of TRUE and FALSE are determined by the value being either zero (0) or not zero (any other number) and it is the main advantage of a boolean return value, you only ever need to test the value against 0.