Switch

Files used -> 5-switch.c, 5-switch.exe

If we think switch in simple language, switch is a multiple if statement or multiple conditions operation. So from 1 block many branches can originates depending upon the number of conditions in switch.

If we look at block 2, we have our prologue, moving value 4 in var_8 variable. Then same value is moved in ecx, decremented by 1. Now ecx have value 3, which is then moved to [ebp+var_4]. Var_4 is now compared with 6.

JA instruction → if value of var_4 is more than 6 then jump. Next to it we see a comment default case. That makes sense, in switch when undesirable input is given default case executes.

But here, 3 is less than 6, so no jump will be taken. And execution will move to block 2.

Inside block 2, we are taking on the jump, edx*4 is also mentioned. Possibly 4th position.

We also see a location- off_40109C.

Lets look at it.

Here, we see 7 cases of switch statement, and we are looking for 4th case(highlighted).

Going to that address or 4th case in switch →

This specific case is printing ‘Thursday’, then restoring the stack and finally at the end epilogue.

NOTE:→

Remember in Block 2, we decremented value of 4 by 1. Making it 3.

If we look at this image, we will understand the reason behind it. Indexing of case is starting with 0.

Because of which to execute the 4th case we decremented it by 1.

Lets see the source code→