IDA - large jump table, missing cases in analysis

Question

I have come across the following jump table with a large amount of cases (160+). There seems to be cases missing from IDAs analysis though. For example it skips from cases 22 -> 38 -> 91, and I can see about 10 cases total.

1. Can I expect all switch cases to take up sequential memory? Is it possible the cases aren't missing, just located elsewhere in memory?
2. If they are normally sequential, is IDA just misinterpreting the cases?
3. Can anyone please explain why there are a large amount of cases belonging to this jumptable but I only see a select few?

Instructions around 0052B970, it is the disasm located immediately above the screenshot:

.text:0052B932                loc_52B932:                             ; CODE XREF: sub_52B920+9↑j
.text:0052B932 8A 01                          mov     al, [ecx]
.text:0052B934 3C B5                          cmp     al, 0B5h
.text:0052B936 73 F3                          jnb     short loc_52B92B
.text:0052B938 0F B6 D0                       movzx   edx, al
.text:0052B93B 8B 04 95 E8 0A+                mov     eax, dword_730AE8[edx*4]
.text:0052B942 85 C0                          test    eax, eax
.text:0052B944 57                             push    edi
.text:0052B945 8B 7D 08                       mov     edi, [ebp+arg_0]
.text:0052B948 89 07                          mov     [edi], eax
.text:0052B94A 75 06                          jnz     short loc_52B952
.text:0052B94C 5F                             pop     edi
.text:0052B94D 5E                             pop     esi
.text:0052B94E 5D                             pop     ebp
.text:0052B94F C2 04 00                       retn    4
.text:0052B952                ; ---------------------------------------------------------------------------
.text:0052B952
.text:0052B952                loc_52B952:                             ; CODE XREF: sub_52B920+2A↑j
.text:0052B952 85 C0                          test    eax, eax
.text:0052B954 53                             push    ebx
.text:0052B955 0F 8D DC 01 00+                jge     loc_52BB37
.text:0052B95B 8D 42 EA                       lea     eax, [edx-16h]  ; switch 158 cases
.text:0052B95E 3D 9D 00 00 00                 cmp     eax, 9Dh
.text:0052B963 0F 87 C8 01 00+                ja      loc_52BB31      ; jumptable 0052B970 default case
.text:0052B969 0F B6 80 80 BB+                movzx   eax, ds:byte_52BB80[eax]
.text:0052B970 FF 24 85 44 BB+                jmp     ds:off_52BB44[eax*4] ; switch jump
.text:0052B977                ; ---------------------------------------------------------------------------
.text:0052B977
.text:0052B977                loc_52B977:                             ; CODE XREF: sub_52B920+50↑j
.text:0052B977                                                        ; DATA XREF: .text:off_52BB44↓o
.text:0052B977 83 FE 0D                       cmp     esi, 0Dh        ; jumptable 0052B970 case 22
.text:0052B97A 72 4A                          jb      short loc_52B9C6
.text:0052B97C 0F B7 49 01                    movzx   ecx, word ptr [ecx+1]
.text:0052B980 5B                             pop     ebx
.text:0052B981 89 0F                          mov     [edi], ecx
.text:0052B983 5F                             pop     edi
.text:0052B984 B8 01 00 00 00                 mov     eax, 1
.text:0052B989 5E                             pop     esi
.text:0052B98A 5D                             pop     ebp
.text:0052B98B C2 04 00                       retn    4

Thanks.

Answer 1

This is an example of so called sparse switch table - large range of case values with gaps in them. You can see how it first determines the case index by indexing a byte table then jumps to the handler using an index into the address table. So missing values are normal and expected; they’re handled by the default case.

You can check Rolf’s research into compiler switch implementations and their variations in this article series:

https://www.msreverseengineering.com/blog/2014/6/23/switch-as-binary-search-part-0