0

I recently got into reverse engineering applications for fun. Can someone please help me with this if statement.

140005914  75  38         JNZ       LAB_14000594e
140005916  48  8b  4      MOV       RCX, qword ptr [RSP + 0x58]
14000591b  48  8d  0      LEA       RAX, [s_ELECTRON_ENABLE_LOGGING_1460]      ;  = "ELECTRON_ENABLE_LOGG
140005922  48  8d  5      LEA       RDX, [RSP + 0x48]
140005927  48  89  02     MOV       qword ptr [RDX], RAX => s_ELECTRON_ENA    ;  = "ELECTRON_ENABLE_LOGG
14000592a  48  c7  4      MOV       qword ptr [RDX + 0x8], 0x17
140005932  48  8b  01     MOV       RAX, qword ptr [RCX]
140005935  ff  50  10     CALL      qword ptr [RAX + 0x10]
140005938  84  c0         TEST      AL, AL
14000593a  75  12         JNZ       LAB_14000594e
14000593c  c7  44  2      MOV       dword ptr [RSP + 0x60], 0x0
140005944  b9  04  0      MOV       ECX, 0x4
140005949  e8  02  7      CALL      FUN_14256cd50                              ;  undefined FUN_14256cd50

Which according to Ghidra decompiles to the following.I would like to change it from =='\0' to =='\1'. I know Test AL, AL is doing a comparison, but where does the 0 in the if statement comes from?

if ((char)uVar8 == '\0') {
    pcStack144 = "ELECTRON_ENABLE_LOGGING";
    uStack136 = 0x17;
    cVar4 = (**(code **)(*ppcStack128 + 0x10))();
    if (cVar4 == '\0') {
      auStack120[0] = 0;
      FUN_14256cd50(4);
    }
  }

Thanks in advance.

7
  • jnz is jump if zero flag is not set. so, "if it is zero then". – R4444 Feb 8 at 20:58
  • How can I ignore the jump if flag is set to 1? – fpena06 Feb 8 at 21:56
  • Replace it with nop/jz – eyal karni Feb 9 at 1:40
  • if 0 ==jz if not zero = jnz – blabb Feb 9 at 3:29
  • I changed from jnz to jz. But the application still won't run with this environment variable set. Any ideas? – fpena06 Feb 10 at 0:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.