C++反汇编->多分支if与switch分析
先敲一段代码：
#include <iostream>
using namespace std;
void main()
{
cout<<"hello world"<<endl;
int i=1;
if (i<0)
{
cout<<"i < 0"<<endl;
}
else if(i>0&&i<2)
{
cout<<"i>0 and i<2"<<endl;
}
else
{
cout<<"i>=2"<<endl;
}
int j=2;
switch (j)
{
case 0:
cout<<"j ==0";
break;
case 1:
cout<<"j ==1";
break;
case 2:
cout<<"j ==2";
break;
default:
cout<<"j have no choice";
}
system("pause");
}
switch 语句与if else语句的比较分析我们看一下内容：
DEBUG版：
00401178 . 68 28104000 PUSH test4.00401028
0040117D . 68 70404300 PUSH OFFSET test4.??_C@_0M@BNI@hello?5world?$AA@ ; ASCII "hello world"
00401182 . 68 50B54300 PUSH OFFSET test4.std::cout
00401187 . E8 14FFFFFF CALL test4.004010A0
0040118C . 83C4 08 ADD ESP,8
0040118F . 8BC8 MOV ECX,EAX
00401191 . E8 DDFEFFFF CALL test4.00401073
00401196 . C745 FC 01000>MOV DWORD PTR SS:[EBP-4],1 ; i=1 IF语句开始
0040119D . 837D FC 00 CMP DWORD PTR SS:[EBP-4],0 ; i与0比较大小
004011A1 . 7D 20 JGE SHORT test4.004011C3 ; 大于等于转移 跳转到 该地址
004011A3 . 68 28104000 PUSH test4.00401028
004011A8 . 68 68404300 PUSH OFFSET test4.??_C@_05JDCB@i?5?$DM?50?$AA@ ; 小于则输出 i<0
004011AD . 68 50B54300 PUSH OFFSET test4.std::cout
004011B2 . E8 E9FEFFFF CALL test4.004010A0
004011B7 . 83C4 08 ADD ESP,8
004011BA . 8BC8 MOV ECX,EAX
004011BC . E8 B2FEFFFF CALL test4.00401073
004011C1 . EB 4A JMP SHORT test4.0040120D
004011C3 > 837D FC 00 CMP DWORD PTR SS:[EBP-4],0 ; else if(i>0&&i<2) 开始执行
004011C7 . 7E 26 JLE SHORT test4.004011EF ; 小于等于转移 跳转该地址
004011C9 . 837D FC 02 CMP DWORD PTR SS:[EBP-4],2
004011CD . 7D 20 JGE SHORT test4.004011EF ; 大于等于转移 跳转到 该地址 >2则跳转到输出 i>=2语句
004011CF . 68 28104000 PUSH test4.00401028
004011D4 . 68 58404300 PUSH OFFSET test4.??_C@_0M@PHJF@i?$DO0?5and?5i?$DM2>; ASCII "i>0 and i<2"
004011D9 . 68 50B54300 PUSH OFFSET test4.std::cout
004011DE . E8 BDFEFFFF CALL test4.004010A0
004011E3 . 83C4 08 ADD ESP,8
004011E6 . 8BC8 MOV ECX,EAX
004011E8 . E8 86FEFFFF CALL test4.00401073
004011ED . EB 1E JMP SHORT test4.0040120D
004011EF > 68 28104000 PUSH test4.00401028 ; else{i>2}执行
004011F4 . 68 50404300 PUSH OFFSET test4.??_C@_04GGJ@i?$DO?$DN2?$AA@ ; ASCII "i>=2"
004011F9 . 68 50B54300 PUSH OFFSET test4.std::cout
004011FE . E8 9DFEFFFF CALL test4.004010A0
00401203 . 83C4 08 ADD ESP,8
00401206 . 8BC8 MOV ECX,EAX
00401208 . E8 66FEFFFF CALL test4.00401073
0040120D > C745 F8 02000>MOV DWORD PTR SS:[EBP-8],2 ; b=2 SWITCH语句开始
00401214 . 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
00401217 . 8945 F4 MOV DWORD PTR SS:[EBP-C],EAX
0040121A . 837D F4 00 CMP DWORD PTR SS:[EBP-C],0 ; b与0比较
0040121E . 74 0E JE SHORT test4.0040122E ; 跳转到0040122E位置
00401220 . 837D F4 01 CMP DWORD PTR SS:[EBP-C],1 ; 与1比较
00401224 . 74 1C JE SHORT test4.00401242 ; 跳转到00401242位置
00401226 . 837D F4 02 CMP DWORD PTR SS:[EBP-C],2 ; 与2比较
0040122A . 74 2A JE SHORT test4.00401256 ; 跳转到00401256位置
0040122C . EB 3C JMP SHORT test4.0040126A ; 都没匹配则跳转0040126A位置
0040122E > 68 48404300 PUSH OFFSET test4.??_C@_05LCKF@j?5?$DN?$DN0?$AA@ ; ASCII "j ==0"
00401233 . 68 50B54300 PUSH OFFSET test4.std::cout
00401238 . E8 63FEFFFF CALL test4.004010A0
0040123D . 83C4 08 ADD ESP,8
00401240 . EB 3A JMP SHORT test4.0040127C
00401242 > 68 40404300 PUSH OFFSET test4.??_C@_05BIDC@j?5?$DN?$DN1?$AA@ ; ASCII "j ==1"
00401247 . 68 50B54300 PUSH OFFSET test4.std::cout
0040124C . E8 4FFEFFFF CALL test4.004010A0
00401251 . 83C4 08 ADD ESP,8
00401254 . EB 26 JMP SHORT test4.0040127C
00401256 > 68 38404300 PUSH OFFSET test4.??_C@_05OHIL@j?5?$DN?$DN2?$AA@ ; ASCII "j ==2"
0040125B . 68 50B54300 PUSH OFFSET test4.std::cout
00401260 . E8 3BFEFFFF CALL test4.004010A0
00401265 . 83C4 08 ADD ESP,8
00401268 . EB 12 JMP SHORT test4.0040127C
0040126A > 68 24404300 PUSH OFFSET test4.??_C@_0BB@ICIL@j?5have?5no?5choic>; ASCII "j have no choice"
0040126F . 68 50B54300 PUSH OFFSET test4.std::cout
00401274 . E8 27FEFFFF CALL test4.004010A0
00401279 . 83C4 08 ADD ESP,8
0040127C > 68 1C404300 PUSH OFFSET test4.??_C@_05PBCN@pause?$AA@ ; /command = "pause"
00401281 . E8 9A7E0000 CALL test4.system ; \system
小结：1.switch语句在这个里面是有序线性的，而if语句条件跳转紧跟语句块。
2.当判断分支多时，采用switch语句效率比if语句强。