0

I use IDA pro and along the analysis I try to understand the following function. There is a simple switch case but it appears that all the 13 switch branches do the EXACT same thing. Am I missing something here??? In case it does branch to the same 13 identical branches than why is IDA analyzing it like this or, if this is a compiler issue that what the reason behind this?

The code:

        myFunc         proc near               ; CODE XREF: call_BH32_and_BH32func+46↑p
.text:010CA990                                         ; BH32+12↑p
.text:010CA990                                         ; DATA XREF: ...
.text:010CA990
.text:010CA990 arg_0           = dword ptr  8
.text:010CA990 arg_4           = dword ptr  0Ch
.text:010CA990 arg_8           = dword ptr  10h
.text:010CA990 arg_C           = dword ptr  14h
.text:010CA990 arg_10          = dword ptr  18h
.text:010CA990
.text:010CA990                 push    ebp
.text:010CA991                 mov     ebp, esp
.text:010CA993                 mov     ecx, [ebp+arg_0]
.text:010CA996                 xor     edx, edx
.text:010CA998                 push    esi
.text:010CA999                 mov     esi, [ebp+arg_4]
.text:010CA99C                 push    edi
.text:010CA99D                 mov     edi, 0Dh
.text:010CA9A2                 lea     eax, [ecx+esi]
.text:010CA9A5                 div     edi
.text:010CA9A7                 cmp     edx, 0Ch        ; switch 13 cases
.text:010CA9AA                 ja      loc_10CAAE2     ; jumptable 1017A9B0 default case
.text:010CA9B0                 jmp     ds:off_10CAAE8[edx*4] ; switch jump
.text:010CA9B7 ; ---------------------------------------------------------------------------
.text:010CA9B7
.text:010CA9B7 loc_10CA9B7:                            ; CODE XREF: myFunc+20↑j
.text:010CA9B7                                         ; DATA XREF: .text:off_10CAAE8↓o
.text:010CA9B7                 push    [ebp+arg_10]    ; jumptable 1017A9B0 case 0
.text:010CA9BA                 push    [ebp+arg_C]
.text:010CA9BD                 push    [ebp+arg_8]
.text:010CA9C0                 push    esi
.text:010CA9C1                 push    ecx
.text:010CA9C2                 call    nextFunc
.text:010CA9C7                 add     esp, 14h
.text:010CA9CA                 pop     edi
.text:010CA9CB                 pop     esi
.text:010CA9CC                 pop     ebp
.text:010CA9CD                 retn
.text:010CA9CE ; ---------------------------------------------------------------------------
.text:010CA9CE
.text:010CA9CE loc_10CA9CE:                            ; CODE XREF: myFunc+20↑j
.text:010CA9CE                                         ; DATA XREF: .text:off_10CAAE8↓o
.text:010CA9CE                 push    [ebp+arg_10]    ; jumptable 1017A9B0 case 1
.text:010CA9D1                 push    [ebp+arg_C]
.text:010CA9D4                 push    [ebp+arg_8]
.text:010CA9D7                 push    esi
.text:010CA9D8                 push    ecx
.text:010CA9D9                 call    nextFunc
.text:010CA9DE                 add     esp, 14h
.text:010CA9E1                 pop     edi
.text:010CA9E2                 pop     esi
.text:010CA9E3                 pop     ebp
.text:010CA9E4                 retn
.text:010CA9E5 ; ---------------------------------------------------------------------------
.text:010CA9E5
.text:010CA9E5 loc_10CA9E5:                            ; CODE XREF: myFunc+20↑j
.text:010CA9E5                                         ; DATA XREF: .text:off_10CAAE8↓o
.text:010CA9E5                 push    [ebp+arg_10]    ; jumptable 1017A9B0 case 2
.text:010CA9E8                 push    [ebp+arg_C]
.text:010CA9EB                 push    [ebp+arg_8]
.text:010CA9EE                 push    esi
.text:010CA9EF                 push    ecx
.text:010CA9F0                 call    nextFunc
.text:010CA9F5                 add     esp, 14h
.text:010CA9F8                 pop     edi
.text:010CA9F9                 pop     esi
.text:010CA9FA                 pop     ebp
.text:010CA9FB                 retn
.text:010CA9FC ; ---------------------------------------------------------------------------
.text:010CA9FC
.text:010CA9FC loc_10CA9FC:                            ; CODE XREF: myFunc+20↑j
.text:010CA9FC                                         ; DATA XREF: .text:off_10CAAE8↓o
.text:010CA9FC                 push    [ebp+arg_10]    ; jumptable 1017A9B0 case 3
.text:010CA9FF                 push    [ebp+arg_C]
.text:010CAA02                 push    [ebp+arg_8]
.text:010CAA05                 push    esi
.text:010CAA06                 push    ecx
.text:010CAA07                 call    nextFunc
.text:010CAA0C                 add     esp, 14h
.text:010CAA0F                 pop     edi
.text:010CAA10                 pop     esi
.text:010CAA11                 pop     ebp
.text:010CAA12                 retn
.text:010CAA13 ; ---------------------------------------------------------------------------
.text:010CAA13
.text:010CAA13 loc_10CAA13:                            ; CODE XREF: myFunc+20↑j
.text:010CAA13                                         ; DATA XREF: .text:off_10CAAE8↓o
.text:010CAA13                 push    [ebp+arg_10]    ; jumptable 1017A9B0 case 4
.text:010CAA16                 push    [ebp+arg_C]
.text:010CAA19                 push    [ebp+arg_8]
.text:010CAA1C                 push    esi
.text:010CAA1D                 push    ecx
.text:010CAA1E                 call    nextFunc
.text:010CAA23                 add     esp, 14h
.text:010CAA26                 pop     edi
.text:010CAA27                 pop     esi
.text:010CAA28                 pop     ebp
.text:010CAA29                 retn
.text:010CAA2A ; ---------------------------------------------------------------------------
.text:010CAA2A
.text:010CAA2A loc_10CAA2A:                            ; CODE XREF: myFunc+20↑j
.text:010CAA2A                                         ; DATA XREF: .text:off_10CAAE8↓o
.text:010CAA2A                 push    [ebp+arg_10]    ; jumptable 1017A9B0 case 5
.text:010CAA2D                 push    [ebp+arg_C]
.text:010CAA30                 push    [ebp+arg_8]
.text:010CAA33                 push    esi
.text:010CAA34                 push    ecx
.text:010CAA35                 call    nextFunc
.text:010CAA3A                 add     esp, 14h
.text:010CAA3D                 pop     edi
.text:010CAA3E                 pop     esi
.text:010CAA3F                 pop     ebp
.text:010CAA40                 retn
.text:010CAA41 ; ---------------------------------------------------------------------------
.text:010CAA41
.text:010CAA41 loc_10CAA41:                            ; CODE XREF: myFunc+20↑j
.text:010CAA41                                         ; DATA XREF: .text:off_10CAAE8↓o
.text:010CAA41                 push    [ebp+arg_10]    ; jumptable 1017A9B0 case 6
.text:010CAA44                 push    [ebp+arg_C]
.text:010CAA47                 push    [ebp+arg_8]
.text:010CAA4A                 push    esi
.text:010CAA4B                 push    ecx
.text:010CAA4C                 call    nextFunc
.text:010CAA51                 add     esp, 14h
.text:010CAA54                 pop     edi
.text:010CAA55                 pop     esi
.text:010CAA56                 pop     ebp
.text:010CAA57                 retn
.text:010CAA58 ; ---------------------------------------------------------------------------
.text:010CAA58
.text:010CAA58 loc_10CAA58:                            ; CODE XREF: myFunc+20↑j
.text:010CAA58                                         ; DATA XREF: .text:off_10CAAE8↓o
.text:010CAA58                 push    [ebp+arg_10]    ; jumptable 1017A9B0 case 7
.text:010CAA5B                 push    [ebp+arg_C]
.text:010CAA5E                 push    [ebp+arg_8]
.text:010CAA61                 push    esi
.text:010CAA62                 push    ecx
.text:010CAA63                 call    nextFunc
.text:010CAA68                 add     esp, 14h
.text:010CAA6B                 pop     edi
.text:010CAA6C                 pop     esi
.text:010CAA6D                 pop     ebp
.text:010CAA6E                 retn
.text:010CAA6F ; ---------------------------------------------------------------------------
.text:010CAA6F
.text:010CAA6F loc_10CAA6F:                            ; CODE XREF: myFunc+20↑j
.text:010CAA6F                                         ; DATA XREF: .text:off_10CAAE8↓o
.text:010CAA6F                 push    [ebp+arg_10]    ; jumptable 1017A9B0 case 8
.text:010CAA72                 push    [ebp+arg_C]
.text:010CAA75                 push    [ebp+arg_8]
.text:010CAA78                 push    esi
.text:010CAA79                 push    ecx
.text:010CAA7A                 call    nextFunc
.text:010CAA7F                 add     esp, 14h
.text:010CAA82                 pop     edi
.text:010CAA83                 pop     esi
.text:010CAA84                 pop     ebp
.text:010CAA85                 retn
.text:010CAA86 ; ---------------------------------------------------------------------------
.text:010CAA86
.text:010CAA86 loc_10CAA86:                            ; CODE XREF: myFunc+20↑j
.text:010CAA86                                         ; DATA XREF: .text:off_10CAAE8↓o
.text:010CAA86                 push    [ebp+arg_10]    ; jumptable 1017A9B0 case 9
.text:010CAA89                 push    [ebp+arg_C]
.text:010CAA8C                 push    [ebp+arg_8]
.text:010CAA8F                 push    esi
.text:010CAA90                 push    ecx
.text:010CAA91                 call    nextFunc
.text:010CAA96                 add     esp, 14h
.text:010CAA99                 pop     edi
.text:010CAA9A                 pop     esi
.text:010CAA9B                 pop     ebp
.text:010CAA9C                 retn
.text:010CAA9D ; ---------------------------------------------------------------------------
.text:010CAA9D
.text:010CAA9D loc_10CAA9D:                            ; CODE XREF: myFunc+20↑j
.text:010CAA9D                                         ; DATA XREF: .text:off_10CAAE8↓o
.text:010CAA9D                 push    [ebp+arg_10]    ; jumptable 1017A9B0 case 10
.text:010CAAA0                 push    [ebp+arg_C]
.text:010CAAA3                 push    [ebp+arg_8]
.text:010CAAA6                 push    esi
.text:010CAAA7                 push    ecx
.text:010CAAA8                 call    nextFunc
.text:010CAAAD                 add     esp, 14h
.text:010CAAB0                 pop     edi
.text:010CAAB1                 pop     esi
.text:010CAAB2                 pop     ebp
.text:010CAAB3                 retn
.text:010CAAB4 ; ---------------------------------------------------------------------------
.text:010CAAB4
.text:010CAAB4 loc_10CAAB4:                            ; CODE XREF: myFunc+20↑j
.text:010CAAB4                                         ; DATA XREF: .text:off_10CAAE8↓o
.text:010CAAB4                 push    [ebp+arg_10]    ; jumptable 1017A9B0 case 11
.text:010CAAB7                 push    [ebp+arg_C]
.text:010CAABA                 push    [ebp+arg_8]
.text:010CAABD                 push    esi
.text:010CAABE                 push    ecx
.text:010CAABF                 call    nextFunc
.text:010CAAC4                 add     esp, 14h
.text:010CAAC7                 pop     edi
.text:010CAAC8                 pop     esi
.text:010CAAC9                 pop     ebp
.text:010CAACA                 retn
.text:010CAACB ; ---------------------------------------------------------------------------
.text:010CAACB
.text:010CAACB loc_10CAACB:                            ; CODE XREF: myFunc+20↑j
.text:010CAACB                                         ; DATA XREF: .text:off_10CAAE8↓o
.text:010CAACB                 push    [ebp+arg_10]    ; jumptable 1017A9B0 case 12
.text:010CAACE                 push    [ebp+arg_C]
.text:010CAAD1                 push    [ebp+arg_8]
.text:010CAAD4                 push    esi
.text:010CAAD5                 push    ecx
.text:010CAAD6                 call    nextFunc
.text:010CAADB                 add     esp, 14h
.text:010CAADE                 pop     edi
.text:010CAADF                 pop     esi
.text:010CAAE0                 pop     ebp
.text:010CAAE1                 retn
.text:010CAAE2 ; ---------------------------------------------------------------------------
.text:010CAAE2
.text:010CAAE2 loc_10CAAE2:                            ; CODE XREF: myFunc+1A↑j
.text:010CAAE2                 pop     edi             ; jumptable 1017A9B0 default case
.text:010CAAE3                 xor     eax, eax
.text:010CAAE5                 pop     esi
.text:010CAAE6                 pop     ebp
.text:010CAAE7                 retn
.text:010CAAE7 myFunc       endp
.text:010CAAE7

1 Answer 1

1

Am I missing something here???

No, you aren't. It's just a switch statement with identical branches.

why is IDA analyzing it like this or, if this is a compiler issue that what the reason behind this?

IDA is analysing it this way, because it just shows the disassembly of the machine code produced. The compiler could have produced a code more efficient both with respect to size and speed, but probably just optimization wasn't turned on while compiling.

Consider the following code:

#include <iostream>

void nextFun()
{

}

int main()
{
    int a;
    std::cin >> a;
    switch (a % 6)
    {
    case 0:
        nextFun();
        break;
    case 1:
        nextFun();
        break;
    case 2:
        nextFun();
        break;
    case 3:
        nextFun();
        break;
    case 4:
        nextFun();
        break;
    case 5:
        nextFun();
        break;
    }
}

It contains just six cases, but after compilation illustrates the way how resulting machine code will look like. After compiling it with GCC with optimizations turned off and opening with IDA:IDA-switch-statement

So, it is possible that such a machine code was indeed produced by compiler, especially when it didn't optimize it.

What is the reason for writing such a code?

I suspect that it's either done purposely to have the possibility to patch the binary later on and change program behaviour for some remainders, or just the program author originally wanted the program behaving differently for different remainders, but then changed his mind and just left the switch statement in such a form.

The other possible, though not likely scenario is that the nextFun checks for the place where it was called and depending on that chooses relevant code path - it would be just an obfuscated switch statement.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.