编程技术点滴三（C/C++）

mov ecx,[ebp-2ch]
mov edx,[ecx]
and edx,80000000h
neg edx
sbb edx,edx
neg edx
mov [ebp-38h],edx

其对应的C代码为：

var_38=(*var_2c)&0x80000000?1:0

switch...case语句，在VC6编译器下，比较语句将按照case值由小到大排列，而代码则按照程序员书写的从后到前的顺序汇编：如下面的语句：

switch(var_d8)
{
case 0xff:
{
var_cc=0;
for (;var_cc<4;var_cc++)
{
var_28[var_cc]=arg_1[var_cc];
(&var_28[4])[var_cc]=arg_1[var_cc] ^ (&arg_1[4])[var_cc];
}
p9(var_c8,var_28,arg_2);
break;
}

case 0:
{
var_cc=0;
for (;var_cc<4;var_cc++)
{
arg_2[var_cc]=var_c8[var_cc];
(&arg_2[4])[var_cc]=(&var_c8[4])[var_cc];
}
break;
}

case 1:
{
p9(arg_1,var_c8,arg_2);
break;
}
}

将被汇编成：

cmp dword ptr [ebp-0xDC], 0
je 1_00404D64
cmp dword ptr [ebp-0xDC], 1
je 1_00404DC8
cmp dword ptr [ebp-0xDC], 0xFF
je 1_00404CE2
jmp 1_00404DDF

1_00404CE2:

mov word ptr [ebp-0xCC], 0
jmp 1_00404CFF

1_00404CED:

mov ax, [ebp-0xCC]
add ax, 1
mov [ebp-0xCC], ax

1_00404CFF:

movsx ecx, word ptr [ebp-0xCC]
cmp ecx, 4
jge 1_00404D4B
movsx edx, word ptr [ebp-0xCC]
movsx eax, word ptr [ebp-0xCC]
mov ecx, [ebp+0xC]
mov edx, [ecx+edx*4]
mov [ebp+eax*4-0x28], edx
movsx eax, word ptr [ebp-0xCC]
movsx ecx, word ptr [ebp-0xCC]
mov edx, [ebp+0xC]
mov esi, [ebp+0xC]
mov eax, [edx+eax*4]
xor eax, [esi+ecx*4+0x10]
movsx ecx, word ptr [ebp-0xCC]
mov [ebp+ecx*4-0x18], eax
jmp 1_00404CED

1_00404D4B:

mov edx, [ebp+0x10]
push edx
lea eax, [ebp-0x28]
push eax
lea ecx, [ebp-0xC8]
push ecx
call 1_0040100F
add esp, 0xC
jmp 1_00404DDF

1_00404D64:

mov word ptr [ebp-0xCC], 0
jmp 1_00404D81

1_00404D6F:

mov dx, [ebp-0xCC]
add dx, 1
mov [ebp-0xCC], dx

1_00404D81:

movsx eax, word ptr [ebp-0xCC]
cmp eax, 4
jge 1_00404DC6
movsx ecx, word ptr [ebp-0xCC]
movsx edx, word ptr [ebp-0xCC]
mov eax, [ebp+0x10]
mov ecx, [ebp+ecx*4-0xC8]
mov [eax+edx*4], ecx
movsx edx, word ptr [ebp-0xCC]
movsx eax, word ptr [ebp-0xCC]
mov ecx, [ebp+0x10]
mov edx, [ebp+edx*4-0xB8]
mov [ecx+eax*4+0x10], edx
jmp 1_00404D6F

1_00404DC6:

jmp 1_00404DDF

1_00404DC8:

mov eax, [ebp+0x10]
push eax
lea ecx, [ebp-0xC8]
push ecx
mov edx, [ebp+0xC]
push edx
call 1_0040100F
add esp, 0xC

1_00404DDF:

jmp 1_00404C62